-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from insufficient mitigation of timing side-channels in RSA decryption with PKCS#1 v1.5 padding. M2Crypto's RSA decryption functions (e.g., decrypt) directly interface with OpenSSL's low-level APIs, which historically lacked constant-time processing for padding checks. The advisory explicitly links this to CVE-2020-25657's incomplete fix, confirming the root cause lies in the RSA decryption flow. The functions responsible for padding validation and decryption in the RSA module are the most likely candidates for the vulnerability.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| m2crypto | pip | <= 0.40.1 |