Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-25659: python-cryptography 3.2 is vulnerable to Bleichenbacher timing attacks in the RSA decryption API, via timed processing of valid PKCS#1 v1.5 ciphertext.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | python-cryptography-debuginfo | 0:1.7.2-2.amzn2.0.1 |
| Amazon Linux · 2 | python2-cryptography | 0:1.7.2-2.amzn2.0.1 |
Vulnerabilities 1
-
Medium 5.9
RSA decryption vulnerable to Bleichenbacher timing vulnerability
python-cryptography 3.2 is vulnerable to Bleichenbacher timing attacks in the RSA decryption API, via timed processing of valid PKCS#1 v1.5 ciphertext.
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2020-25659.html