It was found that python-rsa is vulnerable to Bleichenbacher timing attacks. An attacker can use this flaw via the RSA decryption API to decrypt parts of the cipher text encrypted with RSA.

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2150 advisory.

  - It was found that python-rsa is vulnerable to Bleichenbacher timing attacks. An attacker can use this flaw     via the RSA decryption API to decrypt parts of the cipher text encrypted with RSA. (CVE-2020-25658)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2023:0648-1 advisory.

  - It was found that python-rsa is vulnerable to Bleichenbacher timing attacks. An attacker can use this flaw     via the RSA decryption API to decrypt parts of the cipher text encrypted with RSA. (CVE-2020-25658)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:3932-1 advisory.

  - It was found that python-rsa is vulnerable to Bleichenbacher timing attacks. An attacker can use this flaw     via the RSA decryption API to decrypt parts of the cipher text encrypted with RSA. (CVE-2020-25658)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:1716 advisory.

  - python-rsa: bleichenbacher timing oracle attack against RSA decryption (CVE-2020-25658)

  - ceph object gateway: radosgw: CRLF injection (CVE-2021-3524)

  - ceph: Ceph volume does not honour osd_dmcrypt_key_size (CVE-2021-3979)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0637 advisory.

  - ant: insecure temporary file vulnerability (CVE-2020-1945)

  - jenkins-2-plugins/subversion: XML parser is not preventing XML external entity (XXE) attacks     (CVE-2020-2304)

  - jenkins-2-plugins/mercurial: XML parser is not preventing XML external entity (XXE) attacks     (CVE-2020-2305)

  - jenkins-2-plugins/mercurial: Missing permission check in an HTTP endpoint could result in information     disclosure (CVE-2020-2306)

  - jenkins-2-plugins/kubernetes: Jenkins controller environment variables are accessible in Kubernetes Plugin     (CVE-2020-2307)

  - jenkins-2-plugins/kubernetes: Missing permission check in Kubernetes Plugin allows listing pod templates     (CVE-2020-2308)

  - jenkins-2-plugins/kubernetes: Missing permission check in Kubernetes Plugin allows enumerating credentials     IDs (CVE-2020-2309)

  - ant: insecure temporary file (CVE-2020-11979)

  - python-rsa: bleichenbacher timing oracle attack against RSA decryption (CVE-2020-25658)

  - jenkins: Arbitrary file read vulnerability in workspace browsers (CVE-2021-21602)

  - jenkins:  XSS vulnerability in notification bar (CVE-2021-21603)

  - jenkins:  Improper handling of REST API XML deserialization errors (CVE-2021-21604)

  - jenkins:  Path traversal vulnerability in agent names (CVE-2021-21605)

  - jenkins:  Arbitrary file existence check in file fingerprints (CVE-2021-21606)

  - jenkins:  Excessive memory allocation in graph URLs leads to denial of service (CVE-2021-21607)

  - jenkins: Stored XSS vulnerability in button labels (CVE-2021-21608)

  - jenkins:  Missing permission check for paths with specific prefix (CVE-2021-21609)

  - jenkins:  Reflected XSS vulnerability in markup formatter preview (CVE-2021-21610)

  - jenkins:  Stored XSS vulnerability on new item page (CVE-2021-21611)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:5634 advisory.

  - atomic-openshift: cross-namespace owner references can trigger deletions of valid children (CVE-2019-3884)

  - kubernetes: Ceph RBD adminSecrets exposed in logs when loglevel >= 4 (CVE-2020-8566)

  - containerd: credentials leak during image pull (CVE-2020-15157)

  - python-rsa: bleichenbacher timing oracle attack against RSA decryption (CVE-2020-25658)

  - golang: math/big: panic during recursive division of very large numbers (CVE-2020-28362)

  - gogo/protobuf: plugin/unmarshal/unmarshal.go lacks certain index validation (CVE-2021-3121)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
178495	Amazon Linux 2 : python-rsa (ALAS-2023-2150)	Nessus	Amazon Linux Local Security Checks	medium
172252	SUSE SLES12 Security Update : python-rsa (SUSE-SU-2023:0648-1)	Nessus	SuSE Local Security Checks	medium
167331	SUSE SLED15 / SLES15 Security Update : python-rsa (SUSE-SU-2022:3932-1)	Nessus	SuSE Local Security Checks	medium
160541	RHEL 7 / 8 : Red Hat Ceph Storage 4.3 Security and Bug Fix update (Moderate) (RHSA-2022:1716)	Nessus	Red Hat Local Security Checks	medium
147013	RHEL 7 : OpenShift Container Platform 3.11.394 (RHSA-2021:0637)	Nessus	Red Hat Local Security Checks	high
146810	RHEL 7 / 8 : OpenShift Container Platform 4.7.0 (RHSA-2020:5634)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2020-25658

medium

Tenable Plugins

medium

medium

medium

medium

high

high