VYPR
← All advisories
High severityNVD Advisory· Published Jan 11, 2021· Updated Aug 4, 2024

CVE-2020-25659

CVE-2020-25659

Description

python-cryptography 3.2 is vulnerable to Bleichenbacher timing attacks in the RSA decryption API, via timed processing of valid PKCS#1 v1.5 ciphertext.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

python-cryptography 3.2 RSA decryption vulnerable to Bleichenbacher timing attack via PKCS#1 v1.5 ciphertext processing.

CVE-2020-25659 is a vulnerability in the RSA decryption API of python-cryptography version 3.2 that exposes a timing side-channel, enabling Bleichenbacher-style attacks. The flaw stems from the non-constant-time validation of PKCS#1 v1.5 padding, where the processing time differs between valid and invalid ciphertexts [1][2].

An attacker can network-observe timing differences during RSA decryption to gradually narrow down the plaintext. The attack requires the ability to send chosen ciphertexts to the decryption oracle and measure response times, which is feasible in many network scenarios. No authentication is needed to trigger the vulnerable code path [3].

Successful exploitation allows an attacker to recover the plaintext of any RSA-encrypted message, compromising confidentiality of communications protected by the library. This is a classic Bleichenbacher attack, which can be particularly severe in protocols like TLS where RSA decryption is used [3][4].

The maintainers have addressed this in a subsequent release (3.2.1) by implementing constant-time handling of PKCS#1 v1.5 padding [1]. Users are advised to upgrade to the latest version. No workaround is available for the vulnerable version [4].

References
  1. Attempt to mitigate Bleichenbacher attacks on RSA decryption by alex · Pull Request #5507 · pyca/cryptography
  2. NVD - CVE-2020-25659
  3. CVE-2020-25659 - GitHub Advisory Database
  4. advisory-database/vulns/cryptography/PYSEC-2021-62.yaml at main · pypa/advisory-database

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
cryptographyPyPI
< 3.23.2

Affected products

873

Patches

1
58494b41d6ec

Attempt to mitigate Bleichenbacher attacks on RSA decryption (#5507)

https://github.com/pyca/cryptographyAlex GaynorOct 26, 2020via ghsa
commit
3 files changed · +18 −15
  • CHANGELOG.rst+6 −0 modified
    @@ -8,6 +8,12 @@ Changelog
 
 .. note:: This version is not yet released and is under active development.
 
+* **SECURITY ISSUE:** Attempted to make RSA PKCS#1v1.5 decryption more constant
+  time, to protect against Bleichenbacher vulnerabilities. Due to limitations
+  imposed by our API, we cannot completely mitigate this vulnerability and a
+  future release will contain a new API which is designed to be resilient to
+  these for contexts where it is required. Credit to **Hubert Kario** for
+  reporting the issue. *CVE-2020-25659*
 * Support for OpenSSL 1.0.2 has been removed. Users on older version of OpenSSL
   will need to upgrade.
 * Added basic support for PKCS7 signing (including SMIME) via
  • docs/spelling_wordlist.txt+1 −0 modified
    @@ -7,6 +7,7 @@ backend
 Backends
 backends
 bcrypt
+Bleichenbacher
 Blowfish
 boolean
 Botan
  • src/cryptography/hazmat/backends/openssl/rsa.py+11 −15 modified
    @@ -119,23 +119,19 @@ def _enc_dec_rsa_pkey_ctx(backend, key, data, padding_enum, padding):
 
     outlen = backend._ffi.new("size_t *", buf_size)
     buf = backend._ffi.new("unsigned char[]", buf_size)
+    # Everything from this line onwards is written with the goal of being as
+    # constant-time as is practical given the constraints of Python and our
+    # API. See Bleichenbacher's '98 attack on RSA, and its many many variants.
+    # As such, you should not attempt to change this (particularly to "clean it
+    # up") without understanding why it was written this way (see
+    # Chesterton's Fence), and without measuring to verify you have not
+    # introduced observable time differences.
     res = crypt(pkey_ctx, buf, outlen, data, len(data))
+    resbuf = backend._ffi.buffer(buf)[: outlen[0]]
+    backend._lib.ERR_clear_error()
     if res <= 0:
-        _handle_rsa_enc_dec_error(backend, key)
-
-    return backend._ffi.buffer(buf)[: outlen[0]]
-
-
-def _handle_rsa_enc_dec_error(backend, key):
-    errors = backend._consume_errors_with_text()
-    if isinstance(key, _RSAPublicKey):
-        raise ValueError(
-            "Data too long for key size. Encrypt less data or use a "
-            "larger key size.",
-            errors,
-        )
-    else:
-        raise ValueError("Decryption failed.", errors)
+        raise ValueError("Encryption/decryption failed.")
+    return resbuf
 
 
 def _rsa_sig_determine_padding(backend, key, padding, algorithm):

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

10

News mentions

0

No linked articles in our index yet.