Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWhnZ20tanBnMy12NDc2

RSA decryption vulnerable to Bleichenbacher timing vulnerability

RSA decryption was vulnerable to Bleichenbacher timing vulnerabilities, which would impact people using RSA decryption in online scenarios. This is fixed in cryptography 3.2.

Permalink: https://github.com/advisories/GHSA-hggm-jpg3-v476
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWhnZ20tanBnMy12NDc2
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: over 3 years ago
Updated: 3 months ago


CVSS Score: 5.9
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Identifiers: GHSA-hggm-jpg3-v476, CVE-2020-25659
References: Repository: https://github.com/pyca/cryptography
Blast Radius: 30.2

Affected Packages

pypi:cryptography
Dependent packages: 2,599
Dependent repositories: 131,580
Downloads: 247,831,888 last month
Affected Version Ranges: < 3.2
Fixed in: 3.2
All affected versions: 0.2.1, 0.2.2, 0.5.1, 0.5.2, 0.5.3, 0.5.4, 0.6.1, 0.7.1, 0.7.2, 0.8.1, 0.8.2, 0.9.1, 0.9.2, 0.9.3, 1.0.1, 1.0.2, 1.1.1, 1.1.2, 1.2.1, 1.2.2, 1.2.3, 1.3.1, 1.3.2, 1.3.3, 1.3.4, 1.5.1, 1.5.2, 1.5.3, 1.7.1, 1.7.2, 1.8.1, 1.8.2, 2.0.1, 2.0.2, 2.0.3, 2.1.1, 2.1.2, 2.1.3, 2.1.4, 2.2.1, 2.2.2, 2.3.1, 2.4.1, 2.4.2, 2.6.1, 2.9.1, 2.9.2, 3.1.1
All unaffected versions: 3.2.1, 3.3.1, 3.3.2, 3.4.1, 3.4.2, 3.4.3, 3.4.4, 3.4.5, 3.4.6, 3.4.7, 3.4.8, 35.0.0, 36.0.0, 36.0.1, 36.0.2, 37.0.0, 37.0.1, 37.0.2, 37.0.3, 37.0.4, 38.0.0, 38.0.1, 38.0.2, 38.0.3, 38.0.4, 39.0.0, 39.0.1, 39.0.2, 40.0.0, 40.0.1, 40.0.2, 41.0.0, 41.0.1, 41.0.2, 41.0.3, 41.0.4, 41.0.5, 41.0.6, 41.0.7, 42.0.0, 42.0.1, 42.0.2, 42.0.3, 42.0.4, 42.0.5