Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.g., by helping an attacker to infer that an application uses Python-RSA, or if the length of accepted ciphertext affects application behavior (such as by causing excessive memory allocation).

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM host has packages installed that are affected by a vulnerability as referenced in the USN-4478-2 advisory.

  - Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably     have a security-relevant impact, e.g., by helping an attacker to infer that an application uses Python-     RSA, or if the length of accepted ciphertext affects application behavior (such as by causing excessive     memory allocation). (CVE-2020-13757)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2021:2008-1 advisory.

  - Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably     have a security-relevant impact, e.g., by helping an attacker to infer that an application uses Python-     RSA, or if the length of accepted ciphertext affects application behavior (such as by causing excessive     memory allocation). (CVE-2020-13757)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2021:2237-1 advisory.

  - Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably     have a security-relevant impact, e.g., by helping an attacker to infer that an application uses Python-     RSA, or if the length of accepted ciphertext affects application behavior (such as by causing excessive     memory allocation). (CVE-2020-13757)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2021:0901-1 advisory.

  - Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably     have a security-relevant impact, e.g., by helping an attacker to infer that an application uses Python-     RSA, or if the length of accepted ciphertext affects application behavior (such as by causing excessive     memory allocation). (CVE-2020-13757)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2021:2008-1 advisory.

  - Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably     have a security-relevant impact, e.g., by helping an attacker to infer that an application uses Python-     RSA, or if the length of accepted ciphertext affects application behavior (such as by causing excessive     memory allocation). (CVE-2020-13757)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the python-rsa package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - Python-RSA before 4.1 ignores leading '\0' bytes during     decryption of ciphertext. This could conceivably have a     security-relevant impact, e.g., by helping an attacker     to infer that an application uses Python-RSA, or if the     length of accepted ciphertext affects application     behavior (such as by causing excessive memory     allocation).(CVE-2020-13757)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the python-rsa package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - Python-RSA before 4.1 ignores leading '\0' bytes during     decryption of ciphertext. This could conceivably have a     security-relevant impact, e.g., by helping an attacker     to infer that an application uses Python-RSA, or if the     length of accepted ciphertext affects application     behavior (such as by causing excessive memory     allocation).(CVE-2020-13757)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the python-rsa package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - A flaw was found in the python-rsa package, where it     does not explicitly check the ciphertext length against     the key size and ignores the leading 0 bytes during the     decryption of the ciphertext. This flaw allows an     attacker to perform a ciphertext attack, leading to a     denial of service. The highest threat from this     vulnerability is to confidentiality.(CVE-2020-13757)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1421 advisory.

  - Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably     have a security-relevant impact, e.g., by helping an attacker to infer that an application uses Python-     RSA, or if the length of accepted ciphertext affects application behavior (such as by causing excessive     memory allocation). (CVE-2020-13757)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the python-rsa packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - Python-RSA before 4.1 ignores leading '\0' bytes during     decryption of ciphertext. This could conceivably have a     security-relevant impact, e.g., by helping an attacker     to infer that an application uses Python-RSA, or if the     length of accepted ciphertext affects application     behavior (such as by causing excessive memory     allocation).(CVE-2020-13757)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3541 advisory.

  - jenkins-jira-plugin: plugin information disclosure (CVE-2019-16541)

  - python-rsa: decryption of ciphertext leads to DoS (CVE-2020-13757)

  - openshift-ansible: cors allowed origin allows changing url protocol (CVE-2020-1741)

  - jenkins: Stored XSS vulnerability in job build time trend (CVE-2020-2220)

  - jenkins: Stored XSS vulnerability in upstream cause (CVE-2020-2221)

  - jenkins: Stored XSS vulnerability in 'keep forever' badge icons (CVE-2020-2222)

  - jenkins: Stored XSS vulnerability in console links (CVE-2020-2223)

  - jenkins-2-plugins/matrix-project: Stored XSS vulnerability in single axis builds tooltips (CVE-2020-2224)

  - jenkins-2-plugins/matrix-project: Stored XSS vulnerability in multiple axis builds tooltips     (CVE-2020-2225)

  - jenkins-2-plugins/matrix-auth: Stored XSS vulnerability in Matrix Authorization Strategy Plugin     (CVE-2020-2226)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3453 advisory.

  - jenkins-credentials-binding-plugin: information disclosure in build log when build contains no build steps     (CVE-2020-2181)

  - jenkins-credentials-binding-plugin: improper masking of secrets (CVE-2020-2182)

  - jenkins-2-plugins/matrix-project: Stored XSS vulnerability in single axis builds tooltips (CVE-2020-2224)

  - jenkins-2-plugins/matrix-project: Stored XSS vulnerability in multiple axis builds tooltips     (CVE-2020-2225)

  - jenkins-2-plugins/matrix-auth: Stored XSS vulnerability in Matrix Authorization Strategy Plugin     (CVE-2020-2226)

  - python-rsa: decryption of ciphertext leads to DoS (CVE-2020-13757)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.g., by helping an attacker to infer that an application uses Python-RSA, or if the length of accepted ciphertext affects application behavior (such as by causing excessive memory allocation).
(CVE-2020-13757)

Fix CVE-2020-13757

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
183622	Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM : Python-RSA vulnerability (USN-4478-2)	Nessus	Ubuntu Local Security Checks	high
151751	openSUSE 15 Security Update : python-rsa (openSUSE-SU-2021:2008-1)	Nessus	SuSE Local Security Checks	high
151357	SUSE SLES12 Security Update : python-rsa (SUSE-SU-2021:2237-1)	Nessus	SuSE Local Security Checks	high
151067	openSUSE 15 Security Update : python-rsa (openSUSE-SU-2021:0901-1)	Nessus	SuSE Local Security Checks	high
150885	SUSE SLED15 / SLES15 Security Update : python-rsa (SUSE-SU-2021:2008-1)	Nessus	SuSE Local Security Checks	high
142317	EulerOS 2.0 SP2 : python-rsa (EulerOS-SA-2020-2390)	Nessus	Huawei Local Security Checks	high
142111	EulerOS 2.0 SP5 : python-rsa (EulerOS-SA-2020-2267)	Nessus	Huawei Local Security Checks	high
140998	EulerOS Virtualization for ARM 64 3.0.6.0 : python-rsa (EulerOS-SA-2020-2050)	Nessus	Huawei Local Security Checks	high
140837	EulerOS 2.0 SP3 : python-rsa (EulerOS-SA-2020-2070)	Nessus	Huawei Local Security Checks	high
140350	EulerOS Virtualization for ARM 64 3.0.2.0 : python-rsa (EulerOS-SA-2020-1980)	Nessus	Huawei Local Security Checks	high
140090	Amazon Linux AMI : python26-rsa (ALAS-2020-1421)	Nessus	Amazon Linux Local Security Checks	high
139981	EulerOS 2.0 SP8 : python-rsa (EulerOS-SA-2020-1878)	Nessus	Huawei Local Security Checks	high
139919	RHEL 7 : OpenShift Container Platform 3.11 (RHSA-2020:3541)	Nessus	Red Hat Local Security Checks	critical
139621	RHEL 7 : OpenShift Container Platform 4.5.6 (RHSA-2020:3453)	Nessus	Red Hat Local Security Checks	high
139338	Amazon Linux 2 : python-rsa (ALAS-2020-1470)	Nessus	Amazon Linux Local Security Checks	high
138403	Fedora 32 : python-rsa (2020-5ed5627d2b)	Nessus	Fedora Local Security Checks	high
138399	Fedora 31 : python-rsa (2020-253ebe55ff)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2020-13757

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

critical

high

high

high

high