Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.2

Python RSA Decryption API Allows Unencrypted Data Exposure

CVE-2020-25658 · published 5 years ago
Summary

An attacker can use a specific technique to decrypt parts of encrypted data using Python's RSA decryption API, potentially exposing sensitive information. This affects systems using Python's RSA library for encryption. To protect your data, update to a secure version of Python's RSA library or use an alternate encryption method.

What to do
  • Update sybren a. stüvel rsa to version 4.7.
  • Update python-rsa_project python-rsa to version 4.7 or later.
Affected software
Ecosystem VendorProductAffected versions
pip sybren a. stüvel rsa >= 2.1, < 4.7
Fix: upgrade to 4.7
– python-rsa_project python-rsa >= 2.1, < 4.7
cpe:2.3:a:python-rsa_project:python-rsa:*:*:*:*:*:*:*:*
– redhat openstack_platform 13.0
16.0
cpe:2.3:a:redhat:openstack_platform:13.0:*:*:*:*:*:*:*
– fedoraproject fedora 33
34
35
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*
Original advisory text
It was found that python-rsa is vulnerable to Bleichenbacher timing attacks. An attacker can use this flaw via the RSA decryption API to decrypt parts of the cipher text encrypted with RSA.
It was found that python-rsa is vulnerable to Bleichenbacher timing attacks. An attacker can use this flaw via the RSA decryption API to decrypt parts of the cipher text encrypted with RSA.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
8.2 High
Exploitation
2% chance of attack within 30 days
Type
CWE-327Use of a Broken Cryptographic Algorithm
CWE-385Covert Timing Channel
Timeline
Published12 Nov 2020
Updated3 Nov 2026
First seen6 Mar 2026
Sources
GHSA-xrx6-fmxq-rjj2 · GHSA
CVE-2020-25658 · NVD
Track software like this
Free during beta