CVE-2020-25658 Timing attacks in python-rsa
An attacker can exploit timing side-channels in the RSA decryption API to partially decrypt ciphertext, compromising data confidentiality.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-25658?
CVE-2020-25658 is a high-severity vulnerability in Fedoraproject Fedora, published on 12 Nov 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
It was found that python-rsa is vulnerable to Bleichenbacher timing attacks. An attacker can use this flaw via the RSA decryption API to decrypt parts of the cipher text encrypted with RSA.
Which versions are affected by CVE-2020-25658?
3 open source packages ship an affected version, including rsa. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
rsa PyPI | From 2.1 | 4.7 |
rsa PyPI | From 2.1 | 4.7 |
rsa PyPI | From 2.1 | 4.7 |
Linux distribution packages (10)
python-rsa SUSE:Linux Enterprise Micro 5.2 | All versions | 3.4.2-150000.3.7.1 |
python-rsa SUSE:Linux Enterprise Micro 5.3 | All versions | 3.4.2-150000.3.7.1 |
python-rsa SUSE:Linux Enterprise Module for Basesystem 15 SP3 | All versions | 3.4.2-150000.3.7.1 |
python-rsa SUSE:Linux Enterprise Module for Basesystem 15 SP4 | All versions | 3.4.2-150000.3.7.1 |
python-rsa SUSE:Linux Enterprise Module for Package Hub 15 SP3 | All versions | 3.4.2-150000.3.7.1 |
python-rsa SUSE:Linux Enterprise Module for Package Hub 15 SP4 | All versions | 3.4.2-150000.3.7.1 |
python-rsa SUSE:Linux Enterprise Module for Public Cloud 12 | All versions | 3.1.4-12.19.2 |
python-rsa openSUSE:Leap 15.3 | All versions | 3.4.2-150000.3.7.1 |
python-rsa openSUSE:Leap 15.4 | All versions | 3.4.2-150000.3.7.1 |
python-rsa openSUSE:Leap Micro 5.2 | All versions | 3.4.2-150000.3.7.1 |
Products include Fedoraproject Fedora, Python-Rsa Project Python-Rsa, Redhat Openstack Platform.
How do I fix CVE-2020-25658?
Upgrade rsa to 4.7 or later.
Is CVE-2020-25658 being exploited?
There is no known exploitation of CVE-2020-25658 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as DEBIAN-CVE-2020-25658, ECHO-28ab-14a8-957a, GHSA-xrx6-fmxq-rjj2, MGASA-2021-0456, PYSEC-2020-100, SUSE-SU-2022:3932-1 and 2 more.