Description
It was found that python-rsa is vulnerable to Bleichenbacher timing attacks. An attacker can use this flaw via the RSA decryption API to decrypt parts of the cipher text encrypted with RSA.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Sybren A. Stüvel | python-rsa | after 3.0 (inclusive) | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | python-rsa | No fix yet | — |
| Debian 13 | python-rsa | No fix yet | — |
| Debian 12 | python-rsa | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | python-rsa | No fix yet | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | python-rsa | No fix yet | — |
| Ubuntu Pro 18.04 LTS | python-rsa | No fix yet | — |
| Ubuntu Pro 16.04 LTS | python-rsa | No fix yet | — |
| Ubuntu Pro 14.04 LTS | python-rsa | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 4 | cri-o | 1.20.0-0.rhaos4.7.git8921e00.el7.51 | RHSA-2020:5634 |
| Red Hat OpenShift 4 | cri-tools | 1.18.0-3.el7 | RHSA-2020:5634 |
| Red Hat OpenShift 4 | ignition +1 | 2.9.0-2.rhaos4.7.git1d56dc8.el8 | RHSA-2020:5634 |
| Red Hat OpenShift 4 | openshift +1 | 4.7.0-202102060108.p0.git.97095.7271b90.el7 | RHSA-2020:5634 |
| Red Hat OpenShift 4 | python-rsa +1 | 4.7-1.el8 | RHSA-2020:5634 |
| Red Hat OpenShift 3 | jenkins | 2.263.3.1612433584-1.el7 | RHSA-2021:0637 |
| Red Hat OpenShift 3 | jenkins-2-plugins | 3.11.1612862361-1.el7 | RHSA-2021:0637 |
| Red Hat OpenShift 3 | python-rsa +1 | 4.5-3.el7 | RHSA-2021:0637 |
| Red Hat Ceph Storage 4 | ceph +32 | 2:14.2.22-110.el7cp | RHSA-2022:1716 |
| Red Hat Ceph Storage 4 | python-rsa +1 | 4.8-1.el8cp | RHSA-2022:1716 |
| Red Hat Ceph Storage 4 | python3-rbd +4 | 2:14.2.22-110.el8cp | RHSA-2022:1716 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP4 | python-rsa | 3.4.2-150000.3.7.1 | SUSE-SU-2022:3932-1 |
| SLES 15 SP3 | python-rsa | 3.4.2-150000.3.7.1 | SUSE-SU-2022:3932-1 |
| SLES 12 | python-rsa | 3.1.4-12.19.2 | SUSE-SU-2023:0648-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLE Micro 5.3 | python-rsa | 3.4.2-150000.3.7.1 | SUSE-SU-2022:3932-1 |
| SLE Micro 5.2 | python-rsa | 3.4.2-150000.3.7.1 | SUSE-SU-2022:3932-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python-rsa | 4.7.2-1.5 | openSUSE-SU-2026:12041-1, openSUSE-SU-2024:14163-1, openSUSE-SU-2024:11269-1 |
| openSUSE Leap 15.4 | python-rsa | 3.4.2-150000.3.7.1 | SUSE-SU-2022:3932-1 |
| openSUSE Leap 15.3 | python-rsa | 3.4.2-150000.3.7.1 | SUSE-SU-2022:3932-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap Micro 5.2 | python-rsa | 3.4.2-150000.3.7.1 | SUSE-SU-2022:3932-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | python2-rsa +1 | 3.4.1-1.amzn2.0.4 | ALAS2-2023-2150 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | rsa | >= 2.1, < 4.7 | 4.7 | GHSA-xrx6-fmxq-rjj2 |
Advisories 13
- RHSA-2020:5634 Red Hat Security Advisory: OpenShift Container Platform 4.7.0 packages security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- openSUSE-SU-2026:12041-1 python313-rsa-4.9.1-1.4 on GA media SUSE / openSUSE Security Updates · Oct 5, 2026
- RHSA-2021:0637 Red Hat Security Advisory: OpenShift Container Platform 3.11.394 bug fix and security update Red Hat Security Advisories (RHSA) · Aug 12, 2026
- WID-SEC-2024-0794 Dell ECS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- RHSA-2022:1716 Red Hat Security Advisory: Red Hat Ceph Storage 4.3 Security and Bug Fix update Red Hat Security Advisories (RHSA) · Jul 3, 2026
- SUSE-SU-2023:0648-1 Security update for python-rsa SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:3932-1 Security update for python-rsa SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14163-1 python310-rsa-4.9-3.5 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11269-1 python36-rsa-4.7.2-1.5 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- ICSA-24-102-04 Siemens RUGGEDCOM APE1808 CISA ICS & IT advisories · May 13, 2025
- SSA-455250 SSA-455250: Multiple Vulnerabilities in Palo Alto Networks Virtual NGFW on RUGGEDCOM APE1808 Devices Before V11.1.2-h3 Siemens ProductCERT · May 13, 2025
- ALAS2-2023-2150 Moderate: python-rsa security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jul 19, 2023
- WID-SEC-2022-0456 tribe29 checkmk: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff BSI CERT-Bund (WID) · Dec 7, 2022
References
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-25658
- https://github.com/sybrenstuvel/python-rsa/issues/165
- FEDORA-2021-783a157adc vendor-advisory
- FEDORA-2021-c1fef03e71 vendor-advisory
- FEDORA-2021-15e50503d6 vendor-advisory