You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Path to dependency file: clusterfuzz/src/appengine/requirements.txt
Path to vulnerable library: clusterfuzz/src/appengine/requirements.txt,clusterfuzz/src/local/butler/scripts,clusterfuzz/src/appengine/handlers/cron/project,clusterfuzz/src/python/bot/tasks,clusterfuzz/src/platform_requirements.txt
python-cryptography 3.2 is vulnerable to Bleichenbacher timing attacks in the RSA decryption API, via timed processing of valid PKCS#1 v1.5 ciphertext.
mend-for-github-combot
changed the title
CVE-2020-25659 (High) detected in cryptography-3.0-cp27-cp27mu-manylinux2010_x86_64.whl
CVE-2020-25659 (Medium) detected in cryptography-3.0-cp27-cp27mu-manylinux2010_x86_64.whl
Feb 12, 2021
CVE-2020-25659 - Medium Severity Vulnerability
Vulnerable Library - cryptography-3.0-cp27-cp27mu-manylinux2010_x86_64.whl
cryptography is a package which provides cryptographic recipes and primitives to Python developers.
Library home page: https://files.pythonhosted.org/packages/b8/86/2692315807539c0f6452c58661d268c88d5fb79acf6c13279eb7b87ecd81/cryptography-3.0-cp27-cp27mu-manylinux2010_x86_64.whl
Path to dependency file: clusterfuzz/src/appengine/requirements.txt
Path to vulnerable library: clusterfuzz/src/appengine/requirements.txt,clusterfuzz/src/local/butler/scripts,clusterfuzz/src/appengine/handlers/cron/project,clusterfuzz/src/python/bot/tasks,clusterfuzz/src/platform_requirements.txt
Dependency Hierarchy:
Vulnerability Details
python-cryptography 3.2 is vulnerable to Bleichenbacher timing attacks in the RSA decryption API, via timed processing of valid PKCS#1 v1.5 ciphertext.
Publish Date: 2021-01-11
URL: CVE-2020-25659
CVSS 2 Score Details (4.3)
Base Score Metrics not available
Suggested Fix
Type: Change files
Origin: pyca/cryptography@58494b4
Release Date: 2020-10-26
Fix Resolution: Replace or update the following file: rsa.py
The text was updated successfully, but these errors were encountered: