-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| cryptography | pip | < 42.0.0 | 42.0.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from RSA decryption handling in PKCS#1 v1.5 mode without adequate timing attack protections. The Cryptography package's decrypt method in RSAPrivateKey directly interfaces with OpenSSL's vulnerable RSA implementation prior to version 42.0.0. Multiple sources confirm this was due to missing implicit rejection mitigations (Marvin workaround) in the cryptographic backend. The CWE-208 (timing discrepancy) classification and reproduction evidence in issue #9785 demonstrate the function's direct involvement in the vulnerable operation.