Bleichenbacher Timing Attacks in python-cryptography 3.2
Summary
CVE-2020-25659: python-cryptography 3.2 is vulnerable to Bleichenbacher timing attacks in the RSA decryption API, via timed processing of valid PKCS#1 v1.5 ciphertext. Affects py3-cryptography across 2 version ranges.
< 3.2.1-r0
< c9e65222c91df8b6f61650a3460e30232962c1e0
Fixed in 3.2.1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python-cryptography is a library for secure communications and cryptography in Python. It provides various cryptographic algorithms and protocols. The vulnerability affects version 3.2 of the library. This version is vulnerable to Bleichenbacher timing attacks in the RSA decryption API. An attacker can exploit this vulnerability by performing timed processing of valid PKCS#1 v1.5 ciphertext. The vulnerability can lead to unauthorized access to sensitive information.
Vulnerability Detail
The vulnerability in python-cryptography 3.2 allows for Bleichenbacher timing attacks in the RSA decryption API. This attack takes advantage of timing differences in the decryption process to extract sensitive information. By carefully timing the processing of valid PKCS#1 v1.5 ciphertext, an attacker can gain unauthorized access to encrypted data. This can result in the exposure of confidential information and compromise the security of the system.
How To Fix
Minimum fixed version
3.2.1-r0
This is the first release that contains the fix.
sudo apk add --upgrade py3-cryptographyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of python-cryptography to mitigate the risk of exploitation.
Conclusion
The vulnerability in python-cryptography 3.2 exposes systems to Bleichenbacher timing attacks, which can result in unauthorized access to sensitive information. It is crucial to upgrade to the fixed version (3.2.1-r0 or later) to mitigate the risk. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for py3-cryptography →
FAQ
python-cryptography is a library for secure communications and cryptography in Python. It provides various cryptographic algorithms and protocols.
A Bleichenbacher timing attack is a cryptographic attack that exploits timing differences in the decryption process to extract sensitive information.
An attacker can exploit this vulnerability by performing timed processing of valid PKCS#1 v1.5 ciphertext, allowing them to gain unauthorized access to encrypted data.
The vulnerability can lead to unauthorized access to sensitive information, compromising the confidentiality and integrity of the system.
Yes, upgrading to python-cryptography version 3.2.1-r0 or later fixes the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for py3-cryptography.
