title: Python-cryptography: bleichenbacher timing oracle attack against rsa decryption - incomplete fix for cve-2020-25659
description: A flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data.
problem types: Observable Timing Discrepancy
affected:
{
product: cryptography
vendor: n/a
versions:
version: 42.0.0, status: unaffected
}
{
vendor: Red Hat
product: Red Hat Ansible Automation Platform 2
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: python-cryptography
defaultStatus: unaffected
cpes: cpe:/a:redhat:ansible_automation_platform:2
}
{
vendor: Red Hat
product: Red Hat Enterprise Linux 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: python-cryptography
defaultStatus: unknown
cpes: cpe:/o:redhat:enterprise_linux:7
}
{
vendor: Red Hat
product: Red Hat Enterprise Linux 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: python39:3.9/python-cryptography
defaultStatus: affected
cpes: cpe:/o:redhat:enterprise_linux:8
}
{
vendor: Red Hat
product: Red Hat Enterprise Linux 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: python-cryptography
defaultStatus: affected
cpes: cpe:/o:redhat:enterprise_linux:8
}
{
vendor: Red Hat
product: Red Hat Enterprise Linux 9
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: python-cryptography
defaultStatus: affected
cpes: cpe:/o:redhat:enterprise_linux:9
}
{
vendor: Red Hat
product: Red Hat Satellite 6
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: python-cryptography
defaultStatus: unaffected
cpes: cpe:/a:redhat:satellite:6
}
{
vendor: Red Hat
product: Red Hat Update Infrastructure 4 for Cloud Providers
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: python-cryptography
defaultStatus: affected
cpes: cpe:/a:redhat:rhui:4::el8
}
{
product: Fedora 39
vendor: Fedora
collectionURL: https://packages.fedoraproject.org/
packageName: python-cryptography
defaultStatus: unaffected
}
{
product: OpenStack RDO
vendor: RDO
collectionURL: https://repos.fedorapeople.org/repos/openstack/
packageName: python-cryptography
defaultStatus: unaffected
}
{
product: Fedora 38
vendor: Fedora
collectionURL: https://packages.fedoraproject.org/
packageName: python-cryptography
defaultStatus: unaffected
}
metrics:
other: [
content: {'value': 'Moderate', 'namespace': 'https://access.redhat.com/security/updates/classification/'}
type: Red Hat severity rating
]
workarounds: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.