CVE-2020-25659: RSA decryption vulnerable to Bleichenbacher timing vulnerability in cryptography
Summary
CVE-2020-25659: RSA decryption vulnerable to Bleichenbacher timing vulnerability. Affects cryptography versions < 3.2. Fixed in 3.2. How to fix ↓
Also tracked for
- py3-cryptography · Alpine:v3.13
The same CVE-2020-25659 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The cryptography package is an open-source library for various cryptographic operations in Python. It provides functionality for encryption, decryption, digital signatures, and more. The vulnerability in cryptography version 3.2 and below allows for Bleichenbacher timing attacks on RSA decryption. This means that an attacker could potentially exploit the timing differences in RSA decryption to recover the private key and decrypt encrypted data. This vulnerability affects users who utilize RSA decryption in online scenarios.
Vulnerability Detail
The RSA decryption vulnerability in cryptography arises from the implementation's susceptibility to Bleichenbacher timing attacks. These attacks take advantage of timing differences in RSA decryption to gather information about the private key. By carefully measuring the time it takes for decryption operations, an attacker can infer the validity of padding in the decrypted message and eventually recover the private key. This can lead to unauthorized access to encrypted data and compromise the security of the system.
How To Fix
Latest published version: 50.0.2 as of 22 Oct 2026
pip install --upgrade "cryptography==50.0.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.2
This is the first release that contains the fix.
pip install --upgrade "cryptography==3.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the fixed version of the cryptography package to mitigate the risk of exploitation.
Conclusion
The vulnerability in RSA decryption in the cryptography package exposes users to Bleichenbacher timing attacks, potentially leading to unauthorized access to encrypted data. It is crucial to update to cryptography version 3.2 or higher to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for cryptography →
FAQ
The vulnerability allows for Bleichenbacher timing attacks on RSA decryption, which can lead to the recovery of the private key and unauthorized access to encrypted data.
Users who utilize RSA decryption in online scenarios and have cryptography versions 3.2 and below are affected by this vulnerability.
No, there is no known workaround. It is essential to update to the fixed version of the cryptography package.
To fix this vulnerability, upgrade to cryptography version 3.2 or higher by running 'pip install --upgrade cryptography'.
For more information, you can refer to the official GitHub advisory: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/10/GHSA-hggm-jpg3-v476/GHSA-hggm-jpg3-v476.json
References
Related vulnerabilities
Recent vulnerabilities recorded for cryptography.
