high7.5
CVE-2023-50781
m2crypto Bleichenbacher timing attack - incomplete fix for CVE-2020-25657
Impact
A flaw was found in m2crypto. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | m2crypto | <= 0.40.1 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Redhat | Enterprise Linux | Versions 8.0, 9.0 |
| Redhat | Update Infrastructure | Version 4 |
| M2crypto Project | M2crypto | through 0.40.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://access.redhat.com/security/cve/CVE-2023-50781
- https://bugzilla.redhat.com/show_bug.cgi?id=2254426
- https://cert-portal.siemens.com/productcert/html/ssa-265688.html
- https://github.com/advisories/GHSA-944j-8ch6-rf6x
- https://nvd.nist.gov/vuln/detail/CVE-2023-50781
- https://gitlab.com/m2crypto/m2crypto/-/issues/342