CVE:CVE-2020-25657
CNNVD:CNNVD-202011-1402
m2crypto是一个Python的加密和 SSL 工具包。
m2crypto所有版本中存在安全漏洞，通过对有效的PKCS#1 v1.5密文进行定时处理，它们很容易受到RSA解密APlI中的Bleichenbacher定时攻击。
solution:Upgrade m2crypto_project m2crypto to a higher version than *; Upgrade redhat virtualization to a higher version than 4.0,and avoid the version 4.0; Upgrade redhat enterprise_linux to a higher version than 6.0,7.0,and avoid the version 6.0,7.0; Upgrade fedoraproject fedora to a higher version than 33,and avoid the version 33