Medium USN-4613-1 1 CVE

python-cryptography vulnerability

Published Nov 3, 2020 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

Hubert Kario discovered that python-cryptography incorrectly handled certain decryption.
An attacker could possibly use this issue to expose sensitive information.

Fixed packages 3

Release	Package	Fixed in
Ubuntu · 16.04 LTS 16.04:LTS	python-cryptography	1.2.3-1ubuntu0.3
Ubuntu · 18.04 LTS 18.04:LTS	python-cryptography	2.1.4-1ubuntu1.4
Ubuntu · 20.04 LTS 20.04:LTS	python-cryptography	2.8-3ubuntu0.1

Vulnerabilities 1

Medium 5.9

CVE-2020-25659

RSA decryption vulnerable to Bleichenbacher timing vulnerability

python-cryptography 3.2 is vulnerable to Bleichenbacher timing attacks in the RSA decryption API, via timed processing of valid PKCS#1 v1.5 ciphertext.

cryptography python-cryptography python-cryptography py3-cryptography Debian Ubuntu Alpine PyPI

Jan 11, 2021

References

report
https://ubuntu.com/security/CVE-2020-25659