Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-25658: A flaw was found in python-rsa, where it is vulnerable to Bleichenbacher timing attacks. This flaw allows an attacker, via the RSA decryption API, to decrypt parts of the ciphertext encrypted with RSA. The highest threat from this vulnerability is to confidentiality.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | python2-rsa | 0:3.4.1-1.amzn2.0.4 |
| Amazon Linux · 2 | python3-rsa | 0:3.4.1-1.amzn2.0.4 |
Vulnerabilities 1
-
High 7.5
Timing attacks in python-rsa
It was found that python-rsa is vulnerable to Bleichenbacher timing attacks. An attacker can use this flaw via the RSA decryption API to decrypt parts of the cipher text encrypted with RSA.
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2020-25658.html