CVSS: 5.9EPSS: 0%CPEs: 2EXPL: 0CVE-2020-25659 – python-cryptography: Bleichenbacher timing oracle attack against RSA decryption
https://notcve.org/view.php?id=CVE-2020-25659
python-cryptography 3.2 is vulnerable to Bleichenbacher timing attacks in the RSA decryption API, via timed processing of valid PKCS#1 v1.5 ciphertext. python-cryptography versión 3.2, es vulnerable a ataques de sincronización de Bleichenbacher en la API de descifrado RSA, por medio del procesamiento cronometrado de texto cifrado PKCS#1 v1.5 válido A flaw was found in python-cryptography, where it is vulnerable to Bleichenbacher timing attacks. This flaw allows an attacker, via the RSA decryption API, to decrypt parts of the ciphertext encrypted with RSA. The highest threat from this vulnerability is to confidentiality. • https://github.com/pyca/cryptography/pull/5507/commits/ce1bef6f1ee06ac497ca0c837fbd1c7ef6c2472b https://www.oracle.com/security-alerts/cpuapr2022.html https://www.oracle.com/security-alerts/cpujul2022.html https://access.redhat.com/security/cve/CVE-2020-25659 https://bugzilla.redhat.com/show_bug.cgi?id=1889988 • CWE-385: Covert Timing Channel •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2018-10903 – python-cryptography: GCM tag forgery via truncated tag in finalize_with_tag API
https://notcve.org/view.php?id=CVE-2018-10903
A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage. Se ha encontrado un error en python-cryptography, desde la versión 1.9.0 hasta la 2.3. • https://access.redhat.com/errata/RHSA-2018:3600 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10903 https://github.com/pyca/cryptography/pull/4342/commits/688e0f673bfbf43fa898994326c6877f00ab19ef https://usn.ubuntu.com/3720-1 https://access.redhat.com/security/cve/CVE-2018-10903 https://bugzilla.redhat.com/show_bug.cgi?id=1602931 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 0CVE-2016-9243
https://notcve.org/view.php?id=CVE-2016-9243
HKDF in cryptography before 1.5.2 returns an empty byte-string if used with a length less than algorithm.digest_size. HKDF en criptografía en versiones anteriores a 1.5.2 devuelve una cadena de bytes vacía si se utiliza con una longitud inferior que algorithm.digest_size. • http://www.openwall.com/lists/oss-security/2016/11/09/2 http://www.securityfocus.com/bid/94216 http://www.ubuntu.com/usn/USN-3138-1 https://cryptography.io/en/latest/changelog https://github.com/pyca/cryptography/commit/b924696b2e8731f39696584d12cceeb3aeb2d874 https://github.com/pyca/cryptography/issues/3211 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5R2ZOBMPWDFFHUZ6QOZZY36A6H5CGJXL https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraprojec • CWE-20: Improper Input Validation •