GoogleOSV:GHSA-HGGM-JPG3-V476RSA decryption vulnerable to Bleichenbacher timing vulnerability
5.9 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:N/A:N
0.001 Low
EPSS
Percentile
44.1%
RSA decryption was vulnerable to Bleichenbacher timing vulnerabilities, which would impact people using RSA decryption in online scenarios. This is fixed in cryptography 3.2.
| CPE | Name | Operator | Version |
|---|---|---|---|
| cryptography | eq | 1.3.3 | |
| cryptography | eq | 0.2 | |
| cryptography | eq | 1.8.1 | |
| cryptography | eq | 0.8 | |
| cryptography | eq | 2.4 | |
| cryptography | eq | 1.5.2 | |
| cryptography | eq | 0.5.1 | |
| cryptography | eq | 0.8.2 | |
| cryptography | eq | 0.7 | |
| cryptography | eq | 2.1.2 |
References
github.com/pyca/cryptography
github.com/pyca/cryptography/commit/58494b41d6ecb0f56b7c5f05d5f5e3ca0320d494
github.com/pyca/cryptography/pull/5507/commits/ce1bef6f1ee06ac497ca0c837fbd1c7ef6c2472b
github.com/pyca/cryptography/security/advisories/GHSA-hggm-jpg3-v476
nvd.nist.gov/vuln/detail/CVE-2020-25659
pypi.org/project/cryptography
www.oracle.com/security-alerts/cpuapr2022.html
www.oracle.com/security-alerts/cpujul2022.html
Related
5.9 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:N/A:N
0.001 Low
EPSS
Percentile
44.1%