CVSS 3.1
5.9 mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NCVE-2020-25658
Medium (5.9). EPSS 1.7% chance of exploitation in the next 30 days. Fixed in rsa 4.7.
It was found that python-rsa is vulnerable to Bleichenbacher timing attacks. An attacker can use this flaw via the RSA decryption API to decrypt parts of the cipher text encrypted with RSA.
Severity
- EPSS
- 1.7% chance of exploitation in the next 30 days; higher than 76% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-385, CWE-327
- Published
- Modified
- Record from
- the NVD, synced
Affected
- fedoraproject:fedora
- python-rsa_project:python-rsa
- redhat:openstack_platform
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-xrx6-fmxq-rjj2 | PyPI | rsa | >=2.1 <4.7 | 4.7 |
| PYSEC-2020-100 | PyPI | rsa | >=2.1 <4.7 | 4.7 |
References
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-25658
- https://github.com/sybrenstuvel/python-rsa/issues/165
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2SAF67KDGSOHLVFTRDOHNEAFDRSSYIWA/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/APF364QJ2IYLPDNVFBOEJ24QP2WLVLJP/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QY4PJWTYSOV7ZEYZVMYIF6XRU73CY6O7/