CVE Catalog
CVE-2020-25659
MediumSummary
The vulnerability in python-cryptography 3.2 allows Bleichenbacher timing attacks on the RSA decryption API. Attackers can exploit timing differences in processing valid PKCS#1 v1.5 ciphertext.
Risk Assessment
The organization is at risk of decryption of sensitive data transmitted via RSA, potentially leading to information disclosure or communication integrity compromise.
Recommendation
Immediately upgrade python-cryptography to version 3.2.1 or later, which includes a fix eliminating the timing attack vulnerability.
Original NVD description (English source)
python-cryptography 3.2 is vulnerable to Bleichenbacher timing attacks in the RSA decryption API, via timed processing of valid PKCS#1 v1.5 ciphertext.