EIQ-2020-0014

EIQ-2020-0014

CVE-2020-25659

cryptography is vulnerable to timing attacks

11 Nov 2019

3 - HIGH

7.5

(Snyk score)

2.9.0

cryptography versions 3.1.1 and earlier are vulnerable to Bleichenbacher timing attacks that leverage the time the RSA decryption API takes to process valid PKCS#1 v1.5 ciphertext.

cryptography versions 3.2 addresses the issue by trying to make RSA PKCS#1v1.5 decryption more time-uniform.

To mitigate this vulnerability:

• Upgrade cryptography to version 3.2 or later.

2.8.0 and earlier.

For more information, see:

• CVE-2020-25659 on mitre.org

• CWE-208: Observable Timing Discrepancy

• Red Hat Bug 1889988 reporting the vulnerability

• GitHub PR with the fix

   This section is not visible to users accessing the public docs, it's for internal reference   

See also:

• SNYK-PYTHON-CRYPTOGRAPHY-1022152

• Slack convo in PSIRT channel