CVE-2023-52323: pycryptodome Observable Discrepancy
Vulnerability summary
CVE-2023-52323 is a medium (CVSS 5.9) Observable Discrepancy vulnerability in pycryptodome. EPSS estimates a 0.62% chance of exploitation in the next 30 days, higher than 49.6% of scored vulnerabilities.
Not severe (CVSS 5.9, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 10 · Related 2Timeline
- 05-01-2024PublishedVulnerability first disclosed.
- 03-06-2025Last modifiedVulnerability information updated.
Description
PyCryptodome and pycryptodomex before 3.19.1 allow side-channel leakage for OAEP decryption, exploitable for a Manger attack.
CVSS metrics
8 scores · 7 sources · 2 versions- OSV · PypiEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:NDiffers
- OSV · UbuntuEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · WolfiEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · ChainguardEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- NVDNIST5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
0.62%
Chance of exploitation in the next 30 days
Percentile
50%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.62% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Suse188 products
- python-aliyun-python-sdk-aas&distro=SUSE Linux Enterprise Module for Public Cloud 15 SP4< 2.1.1-150400.10.3.1
- python-aliyun-python-sdk-aas&distro=SUSE Linux Enterprise Module for Public Cloud 15 SP5< 2.1.1-150400.10.3.1
- python-aliyun-python-sdk-aas&distro=SUSE Linux Enterprise Module for Public Cloud 15 SP6< 2.1.1-150400.10.3.1
- python-aliyun-python-sdk-acm&distro=SUSE Linux Enterprise Module for Public Cloud 15 SP4< 1.0.1-150400.10.3.1
- python-aliyun-python-sdk-acm&distro=SUSE Linux Enterprise Module for Public Cloud 15 SP5< 1.0.1-150400.10.3.1
Opensuse4 products
- python-pycryptodome&distro=openSUSE Leap 15.5< 3.9.0-150200.9.1
- python-pycryptodome&distro=openSUSE Tumbleweed< 3.23.0-1.6
- python-pycryptodomex&distro=openSUSE Leap 15.5< 3.9.9-150300.3.3.1
- python-pycryptodomex&distro=openSUSE Tumbleweed< 3.23.0-1.6
Pycryptodome2 products
- pycryptodome< 3.19.1
- pycryptodomex< 3.19.1
PyPI2 products
- pycryptodome< 3.19.1
- pycryptodomex< 3.19.1
Chainguard1 product
- jwt-tool< 2.2.6-r2
Debian1 product
- pycryptodomeAll versions (No fix recorded) | < 3.20.0+dfsg-1
Ubuntu1 product
- pycryptodomeAll versions (No fix recorded) | < 3.11.0+dfsg1-3ubuntu0.1
Wolfi1 product
- jwt-tool< 2.2.6-r2
8 vendors · 200 products · Showing 200 of 931
