GitHub Advisoryadvisory · PyPI

GHSA-944j-8ch6-rf6x m2crypto Bleichenbacher timing attack - incomplete fix for CVE-2020-25657

MEDIUM Published 2024-02-05 Modified 2026-02-27 Official page ↗

Aliases: CVE-2023-50781
Ecosystem: PyPI
Packages: m2crypto
Severity: Moderate
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses: CWE-203, CWE-208, CWE-385
Reviewed: 2024-02-05

Affected packages

• PyPI m2crypto: <= 0.40.1 (no fix yet)

Description

A flaw was found in m2crypto. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data.

Alias · CVE (1)

CVE-2023-50781 A flaw was found in m2crypto. vulnerability

Weakness · CWE (3)

CWE-203 Observable Discrepancy weakness
CWE-208 Observable Timing Discrepancy weakness
CWE-385 Covert Timing Channel weakness

References

https://nvd.nist.gov/vuln/detail/CVE-2023-50781 advisory
https://access.redhat.com/security/cve/CVE-2023-50781 web
https://bugzilla.redhat.com/show_bug.cgi?id=2254426 web
https://gitlab.com/m2crypto/m2crypto package
https://gitlab.com/m2crypto/m2crypto/-/issues/342 web