Vulnerabilities
Misconfiguration
Compliance
CVE Vulnerabilities

CVE-2020-25658

Covert Timing Channel

Published: Nov 12, 2020 | Modified: Nov 21, 2024
CVSS 3.x
5.9
MEDIUM
Source:
NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.x
4.3 MEDIUM
AV:N/AC:M/Au:N/C:P/I:N/A:N
RedHat/V2
RedHat/V3
5.9 MODERATE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Ubuntu
MEDIUM
Vulnerability-free packages from our partners
root.io logo minimus.io logo echo.ai logo
Additional information
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2020-25658
CWEhttps://cwe.mitre.org/data/definitions/385.html

It was found that python-rsa is vulnerable to Bleichenbacher timing attacks. An attacker can use this flaw via the RSA decryption API to decrypt parts of the cipher text encrypted with RSA.

Weakness

Covert timing channels convey information by modulating some aspect of system behavior over time, so that the program receiving the information can observe system behavior and infer protected information.

Affected Software

NameVendorStart VersionEnd Version
Python-rsaPython-rsa_project2.1 (including)4.7 (excluding)
Red Hat Ceph Storage 4.3RedHatpython-rsa-0:4.8-1.el8cp*
Red Hat OpenShift Container Platform 3.11RedHatpython-rsa-0:4.5-3.el7*
Red Hat OpenShift Container Platform 4.7RedHatpython-rsa-0:4.7-1.el8*
Python-rsaUbuntubionic*
Python-rsaUbuntudevel*
Python-rsaUbuntuesm-apps/bionic*
Python-rsaUbuntuesm-apps/focal*
Python-rsaUbuntuesm-apps/jammy*
Python-rsaUbuntuesm-apps/xenial*
Python-rsaUbuntuesm-infra-legacy/trusty*
Python-rsaUbuntufocal*
Python-rsaUbuntugroovy*
Python-rsaUbuntuhirsute*
Python-rsaUbuntuimpish*
Python-rsaUbuntujammy*
Python-rsaUbuntukinetic*
Python-rsaUbuntulunar*
Python-rsaUbuntutrusty*
Python-rsaUbuntutrusty/esm*
Python-rsaUbuntuupstream*
Python-rsaUbuntuxenial*

Extended Description

In some instances, knowing when data is transmitted between parties can provide a malicious user with privileged information. Also, externally monitoring the timing of operations can potentially reveal sensitive data. For example, a cryptographic operation can expose its internal state if the time it takes to perform the operation varies, based on the state. Covert channels are frequently classified as either storage or timing channels. Some examples of covert timing channels are the system’s paging rate, the time a certain transaction requires to execute, and the time it takes to gain access to a shared bus.

Potential Mitigations

References

Aqua Security is the largest pure-play cloud native security company, providing customers the freedom to innovate and run their businesses with minimal friction. The Aqua Cloud Native Security Platform provides prevention, detection, and response automation across the entire application lifecycle to secure the build, secure cloud infrastructure and secure running workloads wherever they are deployed.
Copyright © 2026 Aqua Security Software Ltd.   Privacy Policy | Terms of Use