high7.5
CVE-2023-50782
Python Cryptography package vulnerable to Bleichenbacher timing oracle attack
Impact
A flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | cryptography | < 42.0.0 | 42.0.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Redhat | Ansible Automation Platform | Version 2.0 |
| Redhat | Enterprise Linux | Versions 8.0, 9.0 |
| Redhat | Update Infrastructure | Version 4 |
| Cryptography.Io | Cryptography | before 42.0.0 |
| Couchbase | Couchbase Server | Versions 7.6.0, 7.6.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://access.redhat.com/security/cve/CVE-2023-50782
- https://bugzilla.redhat.com/show_bug.cgi?id=2254432
- https://www.couchbase.com/alerts/
- https://github.com/advisories/GHSA-3ww4-gg4f-jr7f
- https://nvd.nist.gov/vuln/detail/CVE-2023-50782
- https://github.com/pyca/cryptography/issues/9785
- https://www.couchbase.com/alerts