CVE:CVE-2020-26263
CNNVD:CNNVD-202012-1444
Lennyniu Tlslite-ng是Lennyniu个人开发者的一个基于Python用于提供SSLv3.0, TLS 1.0, TLS 1.1 and TLS 1.2的代码库。
tlslite-ng 0.7.6和0.8.0-alpha39之前存在加密问题漏洞，该漏洞源于在RSA PKCS#1 v1.5解密中执行解密和填充检查的代码依赖于数据。具体来说，代码有多种方式可以泄露关于解密密文的信息。只要明文开头不是0x00, 0x02，它就会中止。所有启用RSA密钥交换的TLS服务器以及直接使用RSA解密API的应用程序都是易受攻击的。
solution:Upgrade tlslite-ng_project tlslite-ng to a higher version than 0.7.6,0.8.0:alpha1,0.8.0:alpha10,0.8.0:alpha11,0.8.0:alpha12,0.8.0:alpha13,0.8.0:alpha14,0.8.0:alpha15,0.8.0:alpha16,0.8.0:alpha17,0.8.0:alpha18,0.8.0:alpha19,0.8.0:alpha2,0.8.0:alpha20,0.8.0:alpha21,0.8.0:alpha22,0.8.0:alpha23,0.8.0:alpha24,0.8.0:alpha25,0.8.0:alpha26,0.8.0:alpha27,0.8.0:alpha28,0.8.0:alpha29,0.8.0:alpha3,0.8.0:alpha30,0.8.0:alpha31,0.8.0:alpha32,0.8.0:alpha33,0.8.0:alpha34,0.8.0:alpha35,0.8.0:alpha36,0.8.0:alpha37,0.8.0:alpha38,0.8.0:alpha4,0.8.0:alpha5,0.8.0:alpha6,0.8.0:alpha7,0.8.0:alpha8,0.8.0:alpha9,and avoid the version (,0.7.6),0.8.0:alpha1,0.8.0:alpha10,0.8.0:alpha11,0.8.0:alpha12,0.8.0:alpha13,0.8.0:alpha14,0.8.0:alpha15,0.8.0:alpha16,0.8.0:alpha17,0.8.0:alpha18,0.8.0:alpha19,0.8.0:alpha2,0.8.0:alpha20,0.8.0:alpha21,0.8.0:alpha22,0.8.0:alpha23,0.8.0:alpha24,0.8.0:alpha25,0.8.0:alpha26,0.8.0:alpha27,0.8.0:alpha28,0.8.0:alpha29,0.8.0:alpha3,0.8.0:alpha30,0.8.0:alpha31,0.8.0:alpha32,0.8.0:alpha33,0.8.0:alpha34,0.8.0:alpha35,0.8.0:alpha36,0.8.0:alpha37,0.8.0:alpha38,0.8.0:alpha4,0.8.0:alpha5,0.8.0:alpha6,0.8.0:alpha7,0.8.0:alpha8,0.8.0:alpha9