title: M2crypto: bleichenbacher timing attacks in the rsa decryption api - incomplete fix for cve-2020-25657
description: A flaw was found in m2crypto. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data.
problem types: Observable Timing Discrepancy
affected:
{
product: m2crypto
vendor: n/a
defaultStatus: affected
}
{
vendor: Red Hat
product: Red Hat Enterprise Linux 6
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: m2crypto
defaultStatus: unknown
cpes: cpe:/o:redhat:enterprise_linux:6
}
{
vendor: Red Hat
product: Red Hat Enterprise Linux 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: m2crypto
defaultStatus: unknown
cpes: cpe:/o:redhat:enterprise_linux:7
}
{
vendor: Red Hat
product: Red Hat Enterprise Linux 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: virt-who
defaultStatus: affected
cpes: cpe:/o:redhat:enterprise_linux:8
}
{
vendor: Red Hat
product: Red Hat Enterprise Linux 9
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: pywbem
defaultStatus: affected
cpes: cpe:/o:redhat:enterprise_linux:9
}
{
vendor: Red Hat
product: Red Hat Enterprise Linux 9
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: virt-who
defaultStatus: affected
cpes: cpe:/o:redhat:enterprise_linux:9
}
{
vendor: Red Hat
product: Red Hat Update Infrastructure 4 for Cloud Providers
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: m2crypto
defaultStatus: affected
cpes: cpe:/a:redhat:rhui:4::el8
}
{
vendor: Red Hat
product: Red Hat Virtualization 4
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: m2crypto
defaultStatus: unaffected
cpes: cpe:/a:redhat:enterprise_linux:8::hypervisor
}
{
product: Fedora
vendor: Fedora
collectionURL: https://packages.fedoraproject.org/
packageName: m2crypto
defaultStatus: affected
}
{
product: Fedora
vendor: Fedora
collectionURL: https://packages.fedoraproject.org/
packageName: pywbem
defaultStatus: affected
}
{
product: Fedora
vendor: Fedora
collectionURL: https://packages.fedoraproject.org/
packageName: virt-who
defaultStatus: affected
}
metrics:
other: [
content: {'value': 'Moderate', 'namespace': 'https://access.redhat.com/security/updates/classification/'}
type: Red Hat severity rating
]
workarounds: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.