CVE-2020-25657

MEDIUM

m2crypto - Covert Timing Channel via RSA Decryption API

Title source: llm

Description

A flaw was found in all released versions of m2crypto, where they are vulnerable to Bleichenbacher timing attacks in the RSA decryption API via the timed processing of valid PKCS#1 v1.5 Ciphertext. The highest threat from this vulnerability is to confidentiality.

References (1)

Core 1

Core References

Issue Tracking, Third Party Advisory x_refsource_misc

https://bugzilla.redhat.com/show_bug.cgi?id=1889823

Scores

CVSS v3 5.9

EPSS 0.0031

EPSS Percentile 54.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

CWE

CWE-385

Status published

Products (5)

fedoraproject/fedora 33

m2crypto_project/m2crypto

redhat/enterprise_linux 6.0

redhat/enterprise_linux 7.0

redhat/virtualization 4.0

Published Jan 12, 2021

Tracked Since Feb 18, 2026