CVE-2020-25659

Name of the Vulnerable Software and Affected Versions python-cryptography versions 3.2

Description The issue is related to errors in RSA key management in the python-cryptography package for the Python programming language. It may allow a remote attacker to gain unauthorized access to protected information. The vulnerability is specifically related to Bleichenbacher timing attacks in the RSA decryption API, which can be exploited through timed processing of valid PKCS#1 v1.5 ciphertext. This could impact users of RSA decryption in online scenarios.

Recommendations For python-cryptography version 3.2, update to a version where the RSA decryption vulnerability is fixed, as the current version is vulnerable to Bleichenbacher timing attacks. As a temporary workaround, consider restricting the use of the RSA decryption API to minimize the risk of exploitation.