CVE-2020-25658: fedoraproject fedora Covert Timing Channel
Vulnerability summary
CVE-2020-25658 is a high (CVSS 7.5) Covert Timing Channel vulnerability in fedoraproject fedora. EPSS estimates a 1.65% chance of exploitation in the next 30 days, higher than 76.5% of scored vulnerabilities. 1 public exploit is recorded.
Public exploit (GitHub, Date unknown)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 6 · Related 3Timeline
- 12-11-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
It was found that python-rsa is vulnerable to Bleichenbacher timing attacks. An attacker can use this flaw via the RSA decryption API to decrypt parts of the cipher text encrypted with RSA.
CVSS metrics
7 scores · 5 sources · 3 versions- OSV · PypiEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NDiffers
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NDiffers
- NVDNIST5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NDiffers
EPSS trend
Probability
1.65%
Chance of exploitation in the next 30 days
Percentile
77%
Versus all other CVEs
30-day change
No change 0.00 pp
From 1.65% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundPython Rsa
Maturity: poc
Weaknesses
CWE · root cause- CWE-385Covert Timing ChannelCovert timing channels convey information by modulating some aspect of system behavior over time, so that the program receiving the information can observe system behavior and infer protected information.
- CWE-327Use of a Broken or Risky Cryptographic AlgorithmThe product uses a broken or risky cryptographic algorithm or protocol.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Suse7 products
- python-rsa&distro=SUSE Linux Enterprise Micro 5.2< 3.4.2-150000.3.7.1
- python-rsa&distro=SUSE Linux Enterprise Micro 5.3< 3.4.2-150000.3.7.1
- python-rsa&distro=SUSE Linux Enterprise Module for Basesystem 15 SP3< 3.4.2-150000.3.7.1
- python-rsa&distro=SUSE Linux Enterprise Module for Basesystem 15 SP4< 3.4.2-150000.3.7.1
- python-rsa&distro=SUSE Linux Enterprise Module for Package Hub 15 SP3< 3.4.2-150000.3.7.1
Opensuse3 products
- python-rsa&distro=openSUSE Leap 15.3< 3.4.2-150000.3.7.1
- python-rsa&distro=openSUSE Leap 15.4< 3.4.2-150000.3.7.1
- python-rsa&distro=openSUSE Leap Micro 5.2< 3.4.2-150000.3.7.1
Debian1 product
- python-rsaAll versions (No fix recorded)
Fedoraproject1 product
- fedoraEOL33 | 34 | 35
Mageia1 product
- python-rsa< 4.7.2-1.mga8
PyPI1 product
- rsa≥ 2.1, < 4.7
Python-rsa_project1 product
- python-rsa≥ 2.1, < 4.7
Redhat1 product
- openstack_platform13.0 | 16.0
Sybren a. stüvel1 product
- python-rsaafter 3.0 (inclusive)
Ubuntu1 product
- python-rsaAll versions (No fix recorded)
10 vendors · 18 products
References
32 links- bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-25658X Refsource CONFIRMWEBREPORTIssue TrackingThird Party Advisory
- github.com/sybrenstuvel/python-rsa/issues/165X Refsource MISCWEBREPORTExploitIssue TrackingThird Party Advisory
