CVE-2023-50781 M2crypto: bleichenbacher timing attacks in the rsa decryption api - incomplete fix for cve-2020-25657
A remote attacker can decrypt captured TLS messages using RSA key exchanges via timing attacks, exposing sensitive data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-50781?
CVE-2023-50781 is a high-severity vulnerability in Redhat Enterprise Linux, published on 5 Feb 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in m2crypto. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data.
Weakness: CWE-203
Which versions are affected by CVE-2023-50781?
3 open source packages ship an affected version, including m2crypto. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
m2crypto PyPI | All versions to 0.40.1 | None |
m2crypto PyPI | All versions to 0.40.1 | None |
m2crypto PyPI | All versions to 0.40.1 | None |
Products include M2crypto Project M2crypto, Redhat Enterprise Linux, Redhat Update Infrastructure.
How do I fix CVE-2023-50781?
Apply the vendor's patch.
Is CVE-2023-50781 being exploited?
There is no known exploitation of CVE-2023-50781 in the wild and no public exploit code.
Sources
Also known as AZL-101841, DEBIAN-CVE-2023-50781, GHSA-944j-8ch6-rf6x, PYSEC-2026-1595, UBUNTU-CVE-2023-50781.