CVE-2023-50782: Python Cryptography Package Vulnerable to Bleichenbacher Timing Oracle Attack
Summary
CVE-2023-50782: Python Cryptography package vulnerable to Bleichenbacher timing oracle attack. Affects cryptography versions < 42.0.0. Fixed in 42.0.0. How to fix ↓
Also tracked for
- python-cryptography · Debian:11
The same CVE-2023-50782 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Python Cryptography package is a widely used library that provides cryptographic recipes and primitives to developers. It supports various encryption algorithms and is essential for secure communication in applications. However, it has a vulnerability that exposes it to a specific type of attack, namely the Bleichenbacher timing oracle attack, which can compromise the security of TLS servers using RSA key exchanges.
Vulnerability Detail
A flaw was identified in the python-cryptography package that allows remote attackers to exploit a timing oracle vulnerability. This vulnerability can enable attackers to decrypt captured messages transmitted over TLS, particularly those using RSA key exchanges. The implications of this vulnerability are severe, as it may lead to the exposure of confidential or sensitive data, potentially affecting the integrity and confidentiality of communications.
How To Fix
Latest published version: 50.0.2 as of 22 Oct 2026
pip install --upgrade "cryptography==50.0.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
42.0.0
This is the first release that contains the fix.
pip install --upgrade "cryptography==42.0.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider disabling RSA key exchanges in your TLS configuration until you can update the cryptography package. This can be done by modifying your server's TLS settings to use alternative key exchange methods that are not affected by this vulnerability.
Conclusion
The vulnerability identified in the Python Cryptography package poses a significant risk to applications using RSA key exchanges in TLS. It is crucial to update to the patched version 42.0.0 or later to mitigate this risk. Additionally, using tools like Vulert can help monitor for vulnerabilities in your software dependencies effectively.
See every vulnerability recorded for cryptography →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The potential consequences include the exposure of sensitive data and the compromise of secure communications, which can lead to data breaches.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just the Pipfile.lock.
If immediate updates are not possible, consider implementing workarounds such as disabling RSA key exchanges in your TLS configuration.
Related vulnerabilities
Recent vulnerabilities recorded for cryptography.
