SB2020111230 - Covert Timing Channel in py3-cryptography (Alpine package)
Published: November 12, 2020
Security Bulletin ID
SB2020111230
Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Information disclosure
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Covert Timing Channel (CVE-ID: CVE-2020-25659)
The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.
python-cryptography 3.2 is vulnerable to Bleichenbacher timing attacks in the RSA decryption API, via timed processing of valid PKCS#1 v1.5 ciphertext.
Remediation
Install update from vendor's website.