Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.g., by helping an attacker to infer that an application uses Python-RSA, or if the length of accepted ciphertext affects application behavior (such as by causing excessive memory allocation).

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM host has packages installed that are affected by a vulnerability as referenced in the USN-4478-2 advisory.

    USN-4478-1 fixed a vulnerability in Python-RSA. This update provides the corresponding update for Ubuntu     16.04 ESM, Ubuntu 18.04 ESM and Ubuntu 20.04 ESM.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2021:2008-1 advisory.

  - Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably     have a security-relevant impact, e.g., by helping an attacker to infer that an application uses Python-     RSA, or if the length of accepted ciphertext affects application behavior (such as by causing excessive     memory allocation). (CVE-2020-13757)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2021:2237-1 advisory.

  - Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably     have a security-relevant impact, e.g., by helping an attacker to infer that an application uses Python-     RSA, or if the length of accepted ciphertext affects application behavior (such as by causing excessive     memory allocation). (CVE-2020-13757)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2021:0901-1 advisory.

  - Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably     have a security-relevant impact, e.g., by helping an attacker to infer that an application uses Python-     RSA, or if the length of accepted ciphertext affects application behavior (such as by causing excessive     memory allocation). (CVE-2020-13757)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2021:2008-1 advisory.

  - Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably     have a security-relevant impact, e.g., by helping an attacker to infer that an application uses Python-     RSA, or if the length of accepted ciphertext affects application behavior (such as by causing excessive     memory allocation). (CVE-2020-13757)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the python-rsa package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - Python-RSA before 4.1 ignores leading '\0' bytes during     decryption of ciphertext. This could conceivably have a     security-relevant impact, e.g., by helping an attacker     to infer that an application uses Python-RSA, or if the     length of accepted ciphertext affects application     behavior (such as by causing excessive memory     allocation).(CVE-2020-13757)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the python-rsa package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - Python-RSA before 4.1 ignores leading '\0' bytes during     decryption of ciphertext. This could conceivably have a     security-relevant impact, e.g., by helping an attacker     to infer that an application uses Python-RSA, or if the     length of accepted ciphertext affects application     behavior (such as by causing excessive memory     allocation).(CVE-2020-13757)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the python-rsa package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - A flaw was found in the python-rsa package, where it     does not explicitly check the ciphertext length against     the key size and ignores the leading 0 bytes during the     decryption of the ciphertext. This flaw allows an     attacker to perform a ciphertext attack, leading to a     denial of service. The highest threat from this     vulnerability is to confidentiality.(CVE-2020-13757)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1421 advisory.

    Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably     have a security-relevant impact, e.g., by helping an attacker to infer that an application uses Python-     RSA, or if the length of accepted ciphertext affects application behavior (such as by causing excessive     memory allocation). A flaw was found in the python-rsa package, where it does not explicitly check the     ciphertext length against the key size and ignores the leading 0 bytes during the decryption of the     ciphertext. This flaw allows an attacker to perform a ciphertext attack, leading to a denial of service.
    The highest threat from this vulnerability is to confidentiality. (CVE-2020-13757)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the python-rsa packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - Python-RSA before 4.1 ignores leading '\0' bytes during     decryption of ciphertext. This could conceivably have a     security-relevant impact, e.g., by helping an attacker     to infer that an application uses Python-RSA, or if the     length of accepted ciphertext affects application     behavior (such as by causing excessive memory     allocation).(CVE-2020-13757)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3541 advisory.

    Jenkins is a continuous integration server that monitors executions of repeated jobs, such as building a     software project or jobs run by cron. The Matrix Project is a module which handles creating Jenkins multi-     configuration projects (matrix projects). Matrix Authorization allows configuring the lowest level     permissions, such as starting new builds,     configuring items, or deleting them, individually.

    Python-RSA is a RSA implementation in Python. It can be used as a Python     library as well as the commandline utility.

    Ansible is a SSH-based configuration management, deployment, and task execution system. The openshift-     ansible packages contain Ansible code and playbooks for installing and upgrading OpenShift Container     Platform 3.

    Security Fix(es):

    * jenkins: Stored XSS vulnerability in job build time trend (CVE-2020-2220)

    * jenkins: Stored XSS vulnerability in upstream cause (CVE-2020-2221)

    * jenkins: Stored XSS vulnerability in 'keep forever' badge icons (CVE-2020-2222)

    * jenkins: Stored XSS vulnerability in console links (CVE-2020-2223)

    * jenkins-2-plugins/matrix-project: Stored XSS vulnerability in single axis builds tooltips     (CVE-2020-2224)

    * jenkins-2-plugins/matrix-project: Stored XSS vulnerability in multiple axis builds tooltips     (CVE-2020-2225)

    * jenkins-2-plugins/matrix-auth: Stored XSS vulnerability in Matrix Authorization Strategy Plugin     (CVE-2020-2226)

    * jenkins-jira-plugin: plugin information disclosure (CVE-2019-16541)

    * python-rsa: decryption of ciphertext leads to DoS (CVE-2020-13757)

    * openshift-ansible: cors allowed origin allows changing url protocol (CVE-2020-1741)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3453 advisory.

    The Matrix Project is a module which handles creating Jenkins multi-configuration projects (matrix     projects). Matrix Authorization allows configuring the lowest level permissions, such as starting new     builds, configuring items, or deleting them, individually.

    Python-RSA is a RSA implementation in Python. It can be used as a Python library as well as the     commandline utility.

    Security Fix(es):

    * jenkins-2-plugins/matrix-project: Stored XSS vulnerability in single axis builds tooltips     (CVE-2020-2224)

    * jenkins-2-plugins/matrix-project: Stored XSS vulnerability in multiple axis builds tooltips     (CVE-2020-2225)

    * jenkins-2-plugins/matrix-auth: Stored XSS vulnerability in Matrix Authorization Strategy Plugin     (CVE-2020-2226)

    * python-rsa: decryption of ciphertext leads to DoS (CVE-2020-13757)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1470 advisory.

    Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably     have a security-relevant impact, e.g., by helping an attacker to infer that an application uses Python-     RSA, or if the length of accepted ciphertext affects application behavior (such as by causing excessive     memory allocation). (CVE-2020-13757)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Fix CVE-2020-13757

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
183622	Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM : Python-RSA vulnerability (USN-4478-2)	Nessus	Ubuntu Local Security Checks	high
151751	openSUSE 15 Security Update : python-rsa (openSUSE-SU-2021:2008-1)	Nessus	SuSE Local Security Checks	high
151357	SUSE SLES12 Security Update : python-rsa (SUSE-SU-2021:2237-1)	Nessus	SuSE Local Security Checks	high
151067	openSUSE 15 Security Update : python-rsa (openSUSE-SU-2021:0901-1)	Nessus	SuSE Local Security Checks	high
150885	SUSE SLED15 / SLES15 Security Update : python-rsa (SUSE-SU-2021:2008-1)	Nessus	SuSE Local Security Checks	high
142317	EulerOS 2.0 SP2 : python-rsa (EulerOS-SA-2020-2390)	Nessus	Huawei Local Security Checks	high
142111	EulerOS 2.0 SP5 : python-rsa (EulerOS-SA-2020-2267)	Nessus	Huawei Local Security Checks	high
140998	EulerOS Virtualization for ARM 64 3.0.6.0 : python-rsa (EulerOS-SA-2020-2050)	Nessus	Huawei Local Security Checks	high
140837	EulerOS 2.0 SP3 : python-rsa (EulerOS-SA-2020-2070)	Nessus	Huawei Local Security Checks	high
140350	EulerOS Virtualization for ARM 64 3.0.2.0 : python-rsa (EulerOS-SA-2020-1980)	Nessus	Huawei Local Security Checks	high
140090	Amazon Linux AMI : python-rsa (ALAS-2020-1421)	Nessus	Amazon Linux Local Security Checks	high
139981	EulerOS 2.0 SP8 : python-rsa (EulerOS-SA-2020-1878)	Nessus	Huawei Local Security Checks	high
139919	RHEL 7 : OpenShift Container Platform 3.11 (RHSA-2020:3541)	Nessus	Red Hat Local Security Checks	critical
139621	RHEL 7 : OpenShift Container Platform 4.5.6 (RHSA-2020:3453)	Nessus	Red Hat Local Security Checks	high
139338	Amazon Linux 2 : python-rsa (ALAS-2020-1470)	Nessus	Amazon Linux Local Security Checks	high
138403	Fedora 32 : python-rsa (2020-5ed5627d2b)	Nessus	Fedora Local Security Checks	high
138399	Fedora 31 : python-rsa (2020-253ebe55ff)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2020-13757

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

critical

high

high

high

high