python-rsa: decryption of ciphertext leads to DoS

🗓️ 18 Aug 2020 05:04:55Reported by RedHatType

Python-rsa decryption ignores leading zeros and length checks, enabling a ciphertext attack that causes denial of service.

Reporter	Title	Published	Views	Family All 85
IBM Security Bulletins	Security Bulletin: IBM Spectrum Discover is vulnerable to multiple vulnerabilities	23 Aug 202222:32	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Python-RSA	29 Aug 202008:56	–	ibm
Tenable Nessus	Amazon Linux 2 : python-rsa (ALAS-2020-1470)	6 Aug 202000:00	–	nessus
Tenable Nessus	Amazon Linux AMI : python-rsa (ALAS-2020-1421)	31 Aug 202000:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP8 : python-rsa (EulerOS-SA-2020-1878)	28 Aug 202000:00	–	nessus
Tenable Nessus	EulerOS Virtualization for ARM 64 3.0.2.0 : python-rsa (EulerOS-SA-2020-1980)	8 Sep 202000:00	–	nessus
Tenable Nessus	EulerOS Virtualization for ARM 64 3.0.6.0 : python-rsa (EulerOS-SA-2020-2050)	29 Sep 202000:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP3 : python-rsa (EulerOS-SA-2020-2070)	28 Sep 202000:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP5 : python-rsa (EulerOS-SA-2020-2267)	30 Oct 202000:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP2 : python-rsa (EulerOS-SA-2020-2390)	3 Nov 202000:00	–	nessus

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	7	any	python2-rsa	0:4.5-1.el7.noarch	python2-rsa-0:4.5-1.el7.noarch.noarch.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2020-13757
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
github	www.github.com/sybrenstuvel/python-rsa/issues/146
nvd	www.nvd.nist.gov/vuln/detail/CVE-2020-13757
cve	www.cve.org/CVERecord

28 Jun 2026 09:06Current

7.3High risk

Vulners AI Score7.3

CVSS 25

CVSS 3.17.5

EPSS0.01359