Covert Timing Channel in python-rsa - CVE-2020-25658

Vulnerability identifier: #VU73108

CSH Severity: Low

CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-25658

CWE-ID: CWE-385

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to a covert timing channel. A remote attacker can perform Bleichenbacher timing attack and decrypt parts of data via the RSA decryption API.

python-rsa
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Manager Proxy
SUSE Manager Server
SUSE Manager Retail Branch Server
openSUSE Leap Micro
SUSE Linux Enterprise Micro
Fedora
SUSE Enterprise Storage
Public Cloud Module
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise High Performance Computing
openSUSE Leap
openEuler
SUSE Linux Enterprise Module for Packagehub Subpackages
tcmu-runner (Red Hat package)
python-rsa
libntirpc (Red Hat package)
python2-rsa
python3-rsa
ceph-iscsi (Red Hat package)
nfs-ganesha (Red Hat package)
ceph-ansible (Red Hat package)
python-rsa (Red Hat package)
ceph (Red Hat package)
Red Hat Ceph Storage

Install updates from vendor's website.

python-rsa - update to 4.7
tcmu-runner (Red Hat package) - addressed in versions 1.5.2-5.el7cp, 1.5.2-5.el8cp
python-rsa - update to 3.1.4-12.19.2
libntirpc (Red Hat package) - addressed in versions 3.4-1.1.el7cp, 3.4-1.1.el8cp
python-rsa - addressed in versions 3.4.2-3.el7, 4.7.2-1.el8, 4.7.2-1.fc33, 4.7.2-1.fc34, 4.7.2-1.fc35
python-rsa - update to 3.4.2-13
python2-rsa - update to 3.4.2-13
python3-rsa - update to 3.4.2-13
python3-rsa - update to 3.4.2-150000.3.7.1
python2-rsa - update to 3.4.2-150000.3.7.1
ceph-iscsi (Red Hat package) - addressed in versions 3.4-5.el7cp, 3.4-5.el8cp
nfs-ganesha (Red Hat package) - addressed in versions 3.5-1.2.el7cp, 3.5-1.2.el8cp
ceph-ansible (Red Hat package) - addressed in versions 4.0.70.3-1.el7cp, 4.0.70.3-1.el8cp
Red Hat Ceph Storage - update to 4.3
python-rsa (Red Hat package) - update to 4.8-1.el8cp
ceph (Red Hat package) - addressed in versions 14.2.22-110.el7cp, 14.2.22-110.el8cp

• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-25658
• https://github.com/sybrenstuvel/python-rsa/issues/165
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/APF364QJ2IYLPDNVFBOEJ24QP2WLVLJP/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2SAF67KDGSOHLVFTRDOHNEAFDRSSYIWA/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QY4PJWTYSOV7ZEYZVMYIF6XRU73CY6O7/

• Bleichenbacher timing attack in python-rsa
• SUSE update for python-rsa
• SUSE update for python-rsa
• openEuler 20.03 LTS update for python-rsa
• Fedora 35 update for python-rsa
• Fedora 34 update for python-rsa
• Fedora 33 update for python-rsa
• Fedora EPEL 7 update for python-rsa
• Fedora EPEL 8 update for python-rsa
• Multiple vulnerabilities in Red Hat Ceph Storage 4