Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.g., by helping an attacker to infer that an application uses Python-RSA, or if the length of accepted ciphertext affects application behavior (such as by causing excessive memory allocation).
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade python2-rsa | Aug 7, 2020 | Jun 1, 2020 |
| Amazon_linux | — | Upgrade python-rsa | Sep 1, 2020 | Jun 1, 2020 |
| Debian | — | Upgrade python-rsa | Jul 30, 2024 | Jun 1, 2020 |
| Huawei Euleros 2_0_sp2 | — | Upgrade python2-rsa | Nov 3, 2020 | Jun 1, 2020 |
| Huawei Euleros 2_0_sp3 | — | Upgrade python2-rsa | Sep 28, 2020 | Jun 1, 2020 |
| Huawei Euleros 2_0_sp5 | — | Upgrade python2-rsa | Nov 2, 2020 | Jun 1, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade python3-rsaUpgrade python2-rsa | Aug 31, 2020 | Jun 1, 2020 |
| Redhat Openshift | — | Upgrade python-rsa | Dec 29, 2020 | May 27, 2020 |
| Suse | — | Upgrade python3-rsaUpgrade python-rsaUpgrade python2-rsa | Jun 18, 2021 | Jun 1, 2020 |
| Ubuntu | — | Upgrade python-rsa (Ubuntu Pro)Upgrade python3-rsa (Ubuntu Pro) | Sep 1, 2020 | Jun 1, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub