CVE-2020-25657 : A flaw was found in all released versions of m2crypto, where they are vulnerable

A flaw was found in all released versions of m2crypto, where they are vulnerable to Bleichenbacher timing attacks in the RSA decryption API via the timed processing of valid PKCS#1 v1.5 Ciphertext. The highest threat from this vulnerability is to confidentiality.

Published 2021-01-12 15:15:14

Updated 2023-02-12 23:40:35

Source Red Hat, Inc.

View at NVD, CVE.org

Products affected by CVE-2020-25657

Redhat » Enterprise Linux » Version: 6.0
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux » Version: 7.0
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
Matching versions
Redhat » Virtualization » Version: 4.0
cpe:2.3:a:redhat:virtualization:4.0:*:*:*:*:*:*:*
Matching versions
Fedoraproject » Fedora » Version: 33
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*
Matching versions
M2crypto Project » M2crypto
cpe:2.3:a:m2crypto_project:m2crypto:*:*:*:*:*:*:*:*
Matching versions

Threat overview for CVE-2020-25657

Top countries where our scanners detected CVE-2020-25657

Top open port discovered on systems with this issue 53

IPs affected by CVE-2020-25657 748,354

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2020-25657!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2020-25657

EPSS FAQ

0.17%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 53 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2020-25657

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.3	MEDIUM	AV:N/AC:M/Au:N/C:P/I:N/A:N	8.6	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
5.9	MEDIUM	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N	2.2	3.6	NIST
Attack Vector: Network Attack Complexity: High Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE ids for CVE-2020-25657

CWE-385 Covert Timing Channel

Covert timing channels convey information by modulating some aspect of system behavior over time, so that the program receiving the information can observe system behavior and infer protected information.

Assigned by: secalert@redhat.com (Primary)

References for CVE-2020-25657

https://bugzilla.redhat.com/show_bug.cgi?id=1889823

1889823 – (CVE-2020-25657) CVE-2020-25657 m2crypto: bleichenbacher timing attacks in the RSA decryption API
Issue Tracking;Third Party Advisory