CVE-2020-13757

Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.g., by helping an attacker to infer that an application uses Python-RSA, or if the length of accepted ciphertext affects application behavior (such as by causing excessive memory allocation).

References

Affected packages

Git / github.com/sybrenstuvel/python-rsa

Affected ranges

Type

GIT

Repo

https://github.com/sybrenstuvel/python-rsa

Events

Introduced

Fixed

c6731b1dda461676b998a18004b23a9879378041

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "4.1"
        }
    ]
}

Affected versions

version-1.*

version-1.1

version-1.2

version-1.3

version-1.3.1

version-1.3.2

version-1.3.3

version-2.*

version-2.0

version-3.*

version-3.0

version-3.0.1

version-3.1

version-3.1.1

version-3.1.2

version-3.1.3

version-3.1.4

version-3.2

version-3.2.1

version-3.2.2

version-3.2.3

version-3.3

version-3.4

version-3.4.1

version-3.4.2

version-4.*

version-4.0

Database specific

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "31"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "32"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "14.04"
            }
        ]
    }
]

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2020-13757.json"