It was found that python-rsa is vulnerable to Bleichenbacher timing attacks. An attacker can use this flaw via the RSA decryption API to decrypt parts of the cipher text encrypted with RSA.

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2150 advisory.

    A flaw was found in python-rsa, where it is vulnerable to Bleichenbacher timing attacks. This flaw allows     an attacker, via the RSA decryption API, to decrypt parts of the ciphertext encrypted with RSA. The     highest threat from this vulnerability is to confidentiality. (CVE-2020-25658)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2023:0648-1 advisory.

  - It was found that python-rsa is vulnerable to Bleichenbacher timing attacks. An attacker can use this flaw     via the RSA decryption API to decrypt parts of the cipher text encrypted with RSA. (CVE-2020-25658)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:3932-1 advisory.

  - It was found that python-rsa is vulnerable to Bleichenbacher timing attacks. An attacker can use this flaw     via the RSA decryption API to decrypt parts of the cipher text encrypted with RSA. (CVE-2020-25658)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:1716 advisory.

    Red Hat Ceph Storage is a scalable, open, software-defined storage platform that combines the most stable     version of the Ceph storage system with a Ceph management platform, deployment utilities, and support     services.

    Security Fix(es):

    * python-rsa: bleichenbacher timing oracle attack against RSA decryption (CVE-2020-25658)

    * ceph object gateway: radosgw: CRLF injection (CVE-2021-3524)

    * ceph: Ceph volume does not honour osd_dmcrypt_key_size (CVE-2021-3979)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    These new packages include numerous bug fixes. Space precludes documenting all of these changes in this     advisory. Users are directed to the Red Hat Ceph Storage Release Notes for information on the most     significant of these changes:

    https://access.redhat.com/documentation/en-us/red_hat_ceph_storage/4.3/html/release_notes/index

    All users of Red Hat Ceph Storage are advised to upgrade to these new packages, which provide bug fixes.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0637 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing     Kubernetes application platform solution designed for on-premise or private     cloud deployments.

    Security Fix(es):

    * jenkins-2-plugins/subversion: XML parser is not preventing XML external entity (XXE) attacks     (CVE-2020-2304)

    * jenkins-2-plugins/mercurial: XML parser is not preventing XML external entity (XXE) attacks     (CVE-2020-2305)

    * ant: Insecure temporary file vulnerability (CVE-2020-1945)

    * jenkins-2-plugins/mercurial: Missing permission check in an HTTP endpoint could result in information     disclosure (CVE-2020-2306)

    * jenkins-2-plugins/kubernetes: Jenkins controller environment variables are accessible in Kubernetes     plug-in (CVE-2020-2307)

    * jenkins-2-plugins/kubernetes: Missing permission check in Kubernetes Plugin allows listing pod templates     (CVE-2020-2308)

    * jenkins-2-plugins/kubernetes: Missing permission check in Kubernetes plug-in allows enumerating     credentials IDs (CVE-2020-2309)

    * ant: Insecure temporary file (CVE-2020-11979)

    * python-rsa: Bleichenbacher timing oracle attack against RSA decryption (CVE-2020-25658)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page(s) listed in the References section.

    This advisory contains the RPM packages for Red Hat OpenShift Container     Platform 3.11.394. See the following advisory for the container images for this release:

    https://access.redhat.com/errata/RHBA-2021:0638

    Space precludes documenting all of the container images in this advisory. See the following Release Notes     documentation, which will be updated shortly for this release, for details about these changes:

    https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html

    This update fixes the following bugs among others:

    * Previously, the restart-cluster playbook did not evaluate the defined cluster size for ops clusters.
    This was causing come clusters to never complete their restart. This bug fix passes the logging ops     cluster size, allowing restarts of ops clusters to complete successfully. (BZ#1879407)

    * Previously, the `openshift_named_certificates` role checked the contents of the `ca-bundle.crt` file     during cluster installation. This caused the check to fail during initial installation because the `ca-     bundle.crt` file is not yet created in that scenario. This bug fix allows the cluster to skip checking the     `ca-bundle.crt` file if it does not exist, resulting in initial installations succeeding. (BZ#1920567)

    * Previously, if the `openshift_release` attribute was not set in the Ansible inventory file, the nodes of     the cluster would fail during an upgrade. This was caused by the `cluster_facts.yml` file being gathered     before the `openshift_release` attribute was defined by the upgrade playbook. Now the `cluster_facts.yml`     file is gathered after the `openshift_version` role runs and the `openshift_release` attribute is set,     allowing for successful node upgrades. (BZ#1921353)

    All OpenShift Container Platform 3.11 users are advised to upgrade to these updated packages and images.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:5634 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing     Kubernetes application platform solution designed for on-premise or private     cloud deployments.

    This advisory contains the RPM packages for Red Hat OpenShift Container     Platform 4.7.0. See the following advisory for the container images for     this release:

    https://access.redhat.com/errata/RHSA-2020:5633

    All OpenShift Container Platform 4.7 users are advised to upgrade to these     updated packages and images when they are available in the appropriate     release channel. To check for available updates, use the OpenShift Console     or the CLI oc command. Instructions for upgrading a cluster are available     at     https://docs.openshift.com/container-platform/4.7/updating/updating-cluster-between-     minor.html#understanding-upgrade-channels_updating-cluster-between-minor.

    Security Fix(es):

    * gogo/protobuf: plugin/unmarshal/unmarshal.go lacks certain index validation (CVE-2021-3121)

    * kubernetes: Ceph RBD adminSecrets exposed in logs when loglevel >= 4 (CVE-2020-8566)

    * containerd: credentials leak during image pull (CVE-2020-15157)

    * python-rsa: bleichenbacher timing oracle attack against RSA decryption (CVE-2020-25658)

    * atomic-openshift: cross-namespace owner references can trigger deletions of valid children     (CVE-2019-3884)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
178495	Amazon Linux 2 : python-rsa (ALAS-2023-2150)	Nessus	Amazon Linux Local Security Checks	medium
172252	SUSE SLES12 Security Update : python-rsa (SUSE-SU-2023:0648-1)	Nessus	SuSE Local Security Checks	medium
167331	SUSE SLED15 / SLES15 Security Update : python-rsa (SUSE-SU-2022:3932-1)	Nessus	SuSE Local Security Checks	medium
160541	RHEL 7 / 8 : Red Hat Ceph Storage 4.3 Security and Bug Fix update (Moderate) (RHSA-2022:1716)	Nessus	Red Hat Local Security Checks	medium
147013	RHEL 7 : OpenShift Container Platform 3.11.394 (RHSA-2021:0637)	Nessus	Red Hat Local Security Checks	high
146810	RHEL 7 / 8 : OpenShift Container Platform 4.7.0 (RHSA-2020:5634)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2020-25658

medium

Tenable Plugins

medium

medium

medium

medium

high

high