CVE-2023-50782

Description

A flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data.

CVSS Metrics

• v4.0•HIGH•Score: 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
• v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Trends

Current EPSS score: 0.88%• Percentile: 76%

Techniques & Countermeasures

• CWE-208•Observable Timing Discrepancy

  Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.

• CWE-385•Covert Timing Channel

  Covert timing channels convey information by modulating some aspect of system behavior over time, so that the program receiving the information can observe system behavior and infer protected information.

• CWE-203•Observable Discrepancy

  The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.

Affected Systems

• couchbase•couchbase_server

  7.6.0 | 7.6.1

• cryptography.io•cryptography

  < 42.0.0

• PyPI•cryptography

  < 42.0.0

• redhat•ansible_automation_platform

  2.0

• redhat•enterprise_linux

  8.0 | 9.0

• redhat•update_infrastructure

  4

References (7)

• https://access.redhat.com/security/cve/CVE-2023-50782
• https://bugzilla.redhat.com/show_bug.cgi?id=2254432
• https://www.couchbase.com/alerts/
• https://nvd.nist.gov/vuln/detail/CVE-2023-50782
• https://github.com/pyca/cryptography/issues/9785
• https://github.com/pyca/cryptography
• https://www.couchbase.com/alerts