GitHub Advisoryadvisory · PyPI

GHSA-3ww4-gg4f-jr7f Python Cryptography package vulnerable to Bleichenbacher timing oracle attack

HIGH Published 2024-02-05 Modified 2026-02-27 Official page ↗
Aliases
CVE-2023-50782
Ecosystem
PyPI
Packages
cryptography
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-203, CWE-208, CWE-385
Reviewed
2024-02-05

Affected packages

• PyPI cryptography: < 42.0.0 → fixed in 42.0.0

Description

A flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data.

Related

Alias · CVE (1)

  • CVE-2023-50782 A flaw was found in the python-cryptography package. vulnerability

Weakness · CWE (3)

  • CWE-203 Observable Discrepancy weakness
  • CWE-208 Observable Timing Discrepancy weakness
  • CWE-385 Covert Timing Channel weakness

References