{"answers":{"affected":"3 open source packages ship an affected version, including tlslite-ng. It affects 1 product.","exploited":"There is no known exploitation of CVE-2020-26263 in the wild and no public exploit code.","fix":"Upgrade tlslite-ng to 0.7.6 or later.","what":"CVE-2020-26263 is a high-severity vulnerability in tlsfuzzer tlslite-ng, published on 21 Dec 2020. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2020-26263 and fix it if it is affected.\n\nWhat it is: CVE-2020-26263 is a high-severity vulnerability in tlsfuzzer tlslite-ng, published on 21 Dec 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2020-26263 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- tlslite-ng (PyPI): affected all versions; fixed in 0.7.6\n- tlslite-ng (PyPI): affected all versions; fixed in 0.7.6\n- tlslite-ng (PyPI): affected all versions; fixed in 0.7.6\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2020-26263/ (Markdown: https://insights.sbomify.com/CVE-2020-26263/index.md)","id":"CVE-2020-26263","markdown":"https://insights.sbomify.com/CVE-2020-26263/index.md","name":"CVE-2020-26263","record":{"aliases":["GHSA-wvcv-832q-fjg7","PYSEC-2020-143","UBUNTU-CVE-2020-26263"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["data_read"],"network_reachable":"yes","non_default_config":false,"product_category":"Python TLS library","requires_auth":"none","summary":"Attackers can exploit timing side-channels in RSA decryption to leak plaintext information, affecting TLS servers and applications using tlslite-ng.","user_interaction":"not_required","vuln_class":"information_disclosure"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"tlslite-ng","vendor":"tlslite-ng_project"}],"cvss":{"score":7.5,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"cwes":[{"id":"CWE-326","name":"Inadequate Encryption Strength"}],"description":"tlslite-ng is an open source python library that implements SSL and TLS cryptographic protocols. In tlslite-ng before versions 0.7.6 and 0.8.0-alpha39, the code that performs decryption and padding check in RSA PKCS#1 v1.5 decryption is data dependant. In particular, the code has multiple ways in which it leaks information about the decrypted ciphertext. It aborts as soon as the plaintext doesn't start with 0x00, 0x02. All TLS servers that enable RSA key exchange as well as applications that use the RSA decryption API directly are vulnerable. This is patched in versions 0.7.6 and 0.8.0-alpha39. Note: the patches depend on Python processing the individual bytes in side-channel free manner, this is known to not the case (see reference). As such, users that require side-channel resistance are recommended to use different TLS implementations, as stated in the security policy of tlslite-ng.","ecosystems":["PyPI"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"RSA vulnerability in tslite-ng","id":"CVE-2020-26263","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"PyPI","product":null,"products":[],"type":"information_disclosure","year":"2020"},"n_packages":3,"n_references":6,"next":{"headline":"LES Server DoS via GetProofsV2","id":"CVE-2020-26264"},"packages":[{"ecosystem":"PyPI","fixed":["0.7.6"],"introduced":["0"],"last_affected":[],"package":"tlslite-ng","purl":null,"source":"GHSA-wvcv-832q-fjg7"},{"ecosystem":"PyPI","fixed":["0.7.6"],"introduced":["0"],"last_affected":[],"package":"tlslite-ng","purl":"pkg:pypi/tlslite-ng","source":"GHSA-wvcv-832q-fjg7"},{"ecosystem":"PyPI","fixed":["0.7.6"],"introduced":["0"],"last_affected":[],"package":"tlslite-ng","purl":"pkg:pypi/tlslite-ng","source":"PYSEC-2020-143"}],"prev":{"headline":"Loopback bypass in Coturn","id":"CVE-2020-26262"},"products":["tlslite-ng"],"published":"2020-12-21","related":[{"cvss_score":5.9,"headline":"tlslite-ng off-by-one error on mac checking","id":"CVE-2018-1000159","kev_date_added":null,"published":"2018-04-18"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"PyPA Advisory Database","prefix":"PYSEC"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2024-08-04","vendors":["tlsfuzzer"]},"summary":"Attackers can exploit timing side-channels in RSA decryption to leak plaintext information, affecting TLS servers and applications using tlslite-ng.","url":"https://insights.sbomify.com/CVE-2020-26263/"}