Skip to content
OpenAdvisories
Medium ALAS2-2020-1470 1 CVE

Moderate: python-rsa security update (Amazon Linux 2)

Published Jul 31, 2020 · Updated Aug 5, 2020

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-13757: Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.g., by helping an attacker to infer that an application uses Python-RSA, or if the length of accepted ciphertext affects application behavior (such as by causing excessive memory allocation). 1848507: CVE-2020-13757 python-rsa: decryption of ciphertext leads to DoS

Fixed packages 1

ReleasePackageFixed in
Amazon Linux · 2 python2-rsa 0:3.4.1-1.amzn2.0.1

Vulnerabilities 1

  • High 7.5
    CVE-2020-13757

    Python-RSA decryption of ciphertext leads to DoS

    Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.g., by helping an attacker to infer that an application uses Python-RSA, or if the length of accepted ciphertext affect…

    rsa python-rsa python-rsa Debian Ubuntu PyPI

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-13757.html