GHSA-hggm-jpg3-v476

RSA decryption vulnerable to Bleichenbacher timing vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2020-25659

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	cryptography	< 3.2	3.2

Details

As written in the advisory (Markdown source, shown as plain text).

RSA decryption was vulnerable to Bleichenbacher timing vulnerabilities, which would impact people using RSA decryption in online scenarios. This is fixed in cryptography 3.2.

References

External links from the advisory. They lead to third-party sites.

https://github.com/pyca/cryptography/security/advisories/GHSA-hggm-jpg3-v476 web
https://nvd.nist.gov/vuln/detail/CVE-2020-25659 advisory
https://github.com/pyca/cryptography/pull/5507 web
https://github.com/pyca/cryptography/commit/58494b41d6ecb0f56b7c5f05d5f5e3ca0320d494 web
https://github.com/advisories/GHSA-hggm-jpg3-v476 advisory
https://github.com/pyca/cryptography package
https://github.com/pypa/advisory-database/tree/main/vulns/cryptography/PYSEC-2021-62.yaml web
https://pypi.org/project/cryptography web
https://www.oracle.com/security-alerts/cpuapr2022.html web
https://www.oracle.com/security-alerts/cpujul2022.html web