Covert Timing Channel in python-cryptography - CVE-2020-25659

Vulnerability identifier: #VU50367

CSH Severity: Medium

CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-25659

CWE-ID: CWE-385

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

python-cryptography 3.2 is vulnerable to Bleichenbacher timing attacks in the RSA decryption API, via timed processing of valid PKCS#1 v1.5 ciphertext.

python-cryptography
PowerStore 9000X
PowerStore 7000X
PowerStore 5000X
PowerStore 3000X
PowerStore 1000X
PowerStoreX OS
PowerScale OneFS
Junos cRPD
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Desktop 15
SUSE CaaS Platform
SUSE Manager Server
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
Fedora
SUSE Enterprise Storage
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Public Cloud Module
SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS
SUSE Linux Enterprise Server 15 SP1 LTSS
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP3 LTSS
Server Applications Module
Basesystem Module
SUSE Package Hub 15
openSUSE Leap
Ubuntu
scap-security-guide (Red Hat package)
cockpit-ovirt (Red Hat package)
imgbased (Red Hat package)
py3-cryptography (Alpine package)
redhat-release-virtualization-host (Red Hat package)
python3-opencensus-context
python3-opencensus-ext-threading
python3-grpcio-gcp
python2-grpcio-gcp
python3-aiocontextvars
python3-Automat
python3-opencensus
python3-pytest-asyncio
python3-knack
openssl11
python3-cryptography (Ubuntu package)
python-cryptography (Ubuntu package)
python3-Deprecated
python3-jsondiff
python2-jsondiff
python3-websocket-client
python3-opentelemetry-api
python3-googleapis-common-protos
python2-googleapis-common-protos
python3-avro
python3-google-api-core
libgrpc++1-debuginfo
python3-grpcio-debuginfo
python3-grpcio
grpc-debuginfo
grpc-debugsource
grpc-devel
python2-grpcio
grpc-devel-debuginfo
libgrpc++1
python2-grpcio-debuginfo
libgrpc8-debuginfo
grpc-source
libgrpc8
python3-PyGithub
ovirt-hosted-engine-ha (Red Hat package)
azure-cli-core
python3-requests
python2-requests
python-cryptography (Red Hat package)
python2-cryptography-vectors
python3-cryptography-vectors
python2-cryptography
python3-cryptography-debuginfo
python3-cryptography
python-cryptography-debugsource
python-cryptography-debuginfo
python2-cryptography-debuginfo
libprotobuf-lite20
libprotobuf20-32bit
libprotobuf-lite20-32bit
libprotoc20-32bit
libprotobuf20-debuginfo
protobuf-debugsource
libprotobuf20
python3-protobuf
protobuf-devel
libprotoc20-debuginfo
libprotobuf-lite20-debuginfo
protobuf-source
libprotoc20
python2-protobuf
protobuf-java
protobuf-devel-debuginfo
python3-pytest
python-zope.interface-debugsource
python3-zope.interface
python3-zope.interface-debuginfo
python-zope.interface-debuginfo
redhat-virtualization-host (Red Hat package)
python2-psutil-debuginfo
python-psutil-debuginfo
python2-psutil
python3-psutil-debuginfo
python3-psutil
python-psutil-debugsource
python-websockets-debugsource
python3-websockets-debuginfo
python3-websockets
python2-humanfriendly
python3-humanfriendly
python3-constantly
python3-hyperlink
python3-incremental
python3-Twisted-debuginfo
python3-Twisted
Spectrum Discover
Juniper Cloud Native Router
IBM Cloud Pak for Multicloud Management
Red Hat Virtualization Host
Red Hat Virtualization
OpenShift Virtualization
IBM Qradar SIEM
UCC Edge
QRadar Deployment Intelligence App
PowerStore T
Dell EMC PowerStore Family Operating System

Install update from vendor's website.

scap-security-guide (Red Hat package) - update to 0.1.54-1.el8ev
cockpit-ovirt (Red Hat package) - update to 0.15.0-2.el8ev
imgbased (Red Hat package) - update to 1.2.19-1.el8ev
Spectrum Discover - addressed in versions 2.0.3.5, 2.0.4.2
IBM Cloud Pak for Multicloud Management - update to 2.3.8
py3-cryptography (Alpine package) - addressed in versions 3.2.1-r0, 3.3.2-r0
redhat-release-virtualization-host (Red Hat package) - update to 4.4.6-1.el8ev
IBM Qradar SIEM - update to 7.5.0 Update Pack 8
python3-opencensus-context - update to 0.1.2-150100.3.3.3
python3-opencensus-ext-threading - update to 0.1.2-150100.3.3.3
python3-grpcio-gcp - update to 0.2.2-150100.3.3.3
python2-grpcio-gcp - update to 0.2.2-150100.3.3.3
python3-aiocontextvars - update to 0.2.2-150100.3.3.3
python3-Automat - update to 0.6.0-150000.3.4.1
python3-opencensus - update to 0.8.0-150100.3.3.3
python3-pytest-asyncio - update to 0.8.0-150100.3.3.3
python3-knack - update to 0.9.0-150100.3.7.3
openssl11 - update to 1.1.1k-7.el7
python3-cryptography (Ubuntu package) - addressed in versions 1.2.3-1ubuntu0.3, 2.1.4-1ubuntu1.4, 2.8-3ubuntu0.1, 3.0-1ubuntu0.1
python-cryptography (Ubuntu package) - addressed in versions 1.2.3-1ubuntu0.3, 2.1.4-1ubuntu1.4, 2.8-3ubuntu0.1
python3-Deprecated - update to 1.2.13-150100.3.3.3
python3-jsondiff - update to 1.3.0-150100.3.6.3
python2-jsondiff - update to 1.3.0-150100.3.6.3
python3-websocket-client - update to 1.3.2-150100.6.7.3
python3-opentelemetry-api - update to 1.5.0-150100.3.3.3
python3-googleapis-common-protos - update to 1.6.0-150100.3.3.3
python2-googleapis-common-protos - update to 1.6.0-150100.3.3.3
python3-avro - update to 1.11.0-150100.3.3.3
python3-google-api-core - update to 1.14.2-150100.3.3.3
libgrpc++1-debuginfo - update to 1.25.0-150100.3.3.3
python3-grpcio-debuginfo - update to 1.25.0-150100.3.3.3
python3-grpcio - update to 1.25.0-150100.3.3.3
grpc-debuginfo - update to 1.25.0-150100.3.3.3
grpc-debugsource - update to 1.25.0-150100.3.3.3
grpc-devel - update to 1.25.0-150100.3.3.3
python2-grpcio - update to 1.25.0-150100.3.3.3
grpc-devel-debuginfo - update to 1.25.0-150100.3.3.3
libgrpc++1 - update to 1.25.0-150100.3.3.3
python2-grpcio-debuginfo - update to 1.25.0-150100.3.3.3
libgrpc8-debuginfo - update to 1.25.0-150100.3.3.3
grpc-source - update to 1.25.0-150100.3.3.3
libgrpc8 - update to 1.25.0-150100.3.3.3
python3-PyGithub - update to 1.43.5-150100.3.3.3
UCC Edge - update to 2.3.1
ovirt-hosted-engine-ha (Red Hat package) - update to 2.4.7-1.el8ev
OpenShift Virtualization - addressed in versions 2.6.6, 4.8.0
azure-cli-core - update to 2.17.1-150100.6.18.1
python3-requests - update to 2.25.1-150100.6.13.3
python2-requests - update to 2.25.1-150100.6.13.3
QRadar Deployment Intelligence App - update to 3.0.16
python-cryptography (Red Hat package) - update to 3.2.1-4.el8
PowerStoreX OS - update to 3.2.1.5-2424458
python2-cryptography-vectors - update to 3.3.2-150100.3.11.3
python3-cryptography-vectors - update to 3.3.2-150100.3.11.3
python2-cryptography - addressed in versions 3.3.2-150100.7.15.3, 3.3.2-150200.16.1
python3-cryptography-debuginfo - addressed in versions 3.3.2-150100.7.15.3, 3.3.2-150200.16.1
python3-cryptography - addressed in versions 3.3.2-150100.7.15.3, 3.3.2-150200.16.1
python-cryptography-debugsource - addressed in versions 3.3.2-150100.7.15.3, 3.3.2-150200.16.1
python-cryptography-debuginfo - addressed in versions 3.3.2-150100.7.15.3, 3.3.2-150200.16.1
python2-cryptography-debuginfo - addressed in versions 3.3.2-150100.7.15.3, 3.3.2-150200.16.1
PowerStore T - update to 3.6.1.2-2315284
libprotobuf-lite20 - update to 3.9.2-150100.8.3.3
libprotobuf20-32bit - update to 3.9.2-150100.8.3.3
libprotobuf-lite20-32bit - update to 3.9.2-150100.8.3.3
libprotoc20-32bit - update to 3.9.2-150100.8.3.3
libprotobuf20-debuginfo - update to 3.9.2-150100.8.3.3
protobuf-debugsource - update to 3.9.2-150100.8.3.3
libprotobuf20 - update to 3.9.2-150100.8.3.3
python3-protobuf - update to 3.9.2-150100.8.3.3
protobuf-devel - update to 3.9.2-150100.8.3.3
libprotoc20-debuginfo - update to 3.9.2-150100.8.3.3
libprotobuf-lite20-debuginfo - update to 3.9.2-150100.8.3.3
protobuf-source - update to 3.9.2-150100.8.3.3
libprotoc20 - update to 3.9.2-150100.8.3.3
python2-protobuf - update to 3.9.2-150100.8.3.3
protobuf-java - update to 3.9.2-150100.8.3.3
protobuf-devel-debuginfo - update to 3.9.2-150100.8.3.3
python3-pytest - update to 3.10.1-150000.7.5.1
Dell EMC PowerStore Family Operating System - update to 4.0.0.0-2284811
python-zope.interface-debugsource - update to 4.4.2-150000.3.4.1
python3-zope.interface - update to 4.4.2-150000.3.4.1
python3-zope.interface-debuginfo - update to 4.4.2-150000.3.4.1
python-zope.interface-debuginfo - update to 4.4.2-150000.3.4.1
redhat-virtualization-host (Red Hat package) - update to 4.4.6-20210527.3.el8_4
python2-psutil-debuginfo - update to 5.9.1-150100.6.6.3
python-psutil-debuginfo - update to 5.9.1-150100.6.6.3
python2-psutil - update to 5.9.1-150100.6.6.3
python3-psutil-debuginfo - update to 5.9.1-150100.6.6.3
python3-psutil - update to 5.9.1-150100.6.6.3
python-psutil-debugsource - update to 5.9.1-150100.6.6.3
python-websockets-debugsource - update to 9.1-150100.3.3.3
python3-websockets-debuginfo - update to 9.1-150100.3.3.3
python3-websockets - update to 9.1-150100.3.3.3
PowerScale OneFS - update to 9.5.0.6
python2-humanfriendly - update to 10.0-150100.6.3.3
python3-humanfriendly - update to 10.0-150100.6.3.3
python3-constantly - update to 15.1.0-150000.3.4.1
python3-hyperlink - update to 17.2.1-150000.3.4.1
python3-incremental - update to 17.5.0-150000.3.4.1
python3-Twisted-debuginfo - update to 17.9.0-150000.3.8.1
python3-Twisted - update to 17.9.0-150000.3.8.1
Junos cRPD - update to 23.4R1
Juniper Cloud Native Router - update to 23.4R1

• https://github.com/pyca/cryptography/pull/5507/commits/ce1bef6f1ee06ac497ca0c837fbd1c7ef6c2472b

• Covert Timing Channel in py3-cryptography (Alpine package)
• Red Hat Enterprise Linux 8 update for python-cryptography
• Multiple vulnerabilities in Red Hat Virtualization for RHEL 8
• Multiple vulnerabilities in IBM Spectrum Discover
• SUSE update for python-cryptography, python-cryptography-vectors
• SUSE update for grpc, protobuf, python-Deprecated, python-PyGithub, python-aiocontextvars, python-avro, python-bcrypt, python-cryptography, python-cryptography-vectors, python-google-api-core, pyt
• SUSE update for grpc, protobuf, python-Deprecated, python-PyGithub, python-aiocontextvars, python-avro, python-bcrypt, python-cryptography, python-cryptography-vectors, python-google-api-core, pyt
• Multiple vulnerabilities in Dell PowerScale OneFS
• Fedora EPEL 7 update for openssl11
• Multiple vulnerabilities in IBM Cloud Pak for Multicloud Management
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in Juniper Cloud Native Router
• Multiple vulnerabilities in Juniper Networks Junos cRPD
• Multiple vulnerabilities in Dell PowerStore Family
• Multiple vulnerabilities in Dell PowerStoreT OS
• Multiple vulnerabilities in OpenShift Virtualization 4.8
• Multiple vulnerabilities in OpenShift Virtualization 2.6
• Multiple vulnerabilities in IBM QRadar Deployment Intelligence App
• Ubuntu update for python-cryptography
• Multiple vulnerabilities in Dell PowerStore X
• Dell UCC Edge update for third-party components