CVE-2020-25659: Vulnerability in python-cryptography 3.2
Summary
CVE-2020-25659: python-cryptography 3.2 is vulnerable to Bleichenbacher timing attacks in the RSA decryption API, via timed processing of valid PKCS#1 v1.5 ciphertext. Affects cryptography versions < 3.2.1. Fixed in 3.2.1. How to fix ↓
Also tracked for
- py3-cryptography · Alpine:v3.13
The same CVE-2020-25659 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python-cryptography is a Python library that provides cryptographic recipes and primitives. It is widely used for secure communication, data encryption, and digital signatures. The library allows developers to implement various cryptographic algorithms and protocols. However, version 3.2 of python-cryptography is vulnerable to Bleichenbacher timing attacks in the RSA decryption API. This vulnerability arises due to timed processing of valid PKCS#1 v1.5 ciphertext. An attacker can exploit this vulnerability to decrypt RSA-encrypted data and potentially gain unauthorized access to sensitive information.
Vulnerability Detail
The vulnerability in python-cryptography 3.2 allows for Bleichenbacher timing attacks in the RSA decryption API. By carefully timing the processing of valid PKCS#1 v1.5 ciphertext, an attacker can exploit the vulnerability to decrypt RSA-encrypted data. This can lead to unauthorized access to sensitive information, compromising the confidentiality and integrity of the data. The vulnerability has been assigned the CVE identifier CVE-2020-25659 and is also tracked as GHSA-hggm-jpg3-v476.
How To Fix
Latest published version: 50.0.2 as of 22 Oct 2026
pip install --upgrade "cryptography==50.0.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.2.1
This is the first release that contains the fix.
pip install --upgrade "cryptography==3.2.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the fixed version of python-cryptography to address the issue.
Conclusion
In conclusion, python-cryptography 3.2 is vulnerable to Bleichenbacher timing attacks in the RSA decryption API. It is crucial for developers to update to version 3.2.1 or later to mitigate the vulnerability and ensure the security of their applications. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for cryptography →
FAQ
python-cryptography is a Python library that provides cryptographic recipes and primitives for secure communication, data encryption, and digital signatures.
The vulnerability allows for Bleichenbacher timing attacks in the RSA decryption API, enabling unauthorized decryption of RSA-encrypted data and potential access to sensitive information.
To fix the vulnerability, upgrade python-cryptography to version 3.2.1 or later, which includes the necessary patches to mitigate the issue.
No, there is no known workaround for this vulnerability. Updating to the fixed version is the recommended solution.
You can find more information about this vulnerability in the official advisory database: https://github.com/pypa/advisory-database/blob/main/vulns/cryptography/PYSEC-2021-62.yaml
References
Related vulnerabilities
Recent vulnerabilities recorded for cryptography.
