CVE-2020-13757
Python-RSA decryption of ciphertext leads to DoS
Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.g., by helping an attacker to infer that an application uses Python-RSA, or if the length of accepted ciphertext affects application behavior (such as by causing excessive memory allocation).
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.g., by helping an attacker to infer that an application uses Python-RSA, or if the length of accepted ciphertext affects application behavior (such as by causing excessive memory allocation).
- Record
CVE-2020-13757- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-327
- Updated
- 2026-11-02
CVE List No score
Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.g., by helping an attacker to infer that an application uses Python-RSA, or if the length of accepted ciphertext affects application behavior (such as by causing excessive memory allocation).
- Record
CVE-2020-13757- Updated
- 2026-11-02
EUVDEUVD-2020-0168 No score
Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.g., by helping an attacker to infer that an application uses Python-RSA, or if the length of accepted ciphertext affects application behavior (such as by causing excessive memory allocation).
- Record
EUVD-2020-0168- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-537h-rv9q-vvph
Python-RSA decryption of ciphertext leads to DoS
Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.g., by helping an attacker to infer that an application uses Python-RSA, or if the length of accepted ciphertext affects application behavior (such as by causing excessive memory allocation).
- Record
GHSA-537h-rv9q-vvph- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-327
- Updated
- 2026-11-02
OSV
Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.g., by helping an attacker to infer that an application uses Python-RSA, or if the length of accepted ciphertext affects application behavior (such as by causing excessive memory allocation).
- Record
CVE-2020-13757- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2020-13757
Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.g., by helping an attacker to infer that an application uses Python-RSA, or if the length of accepted ciphertext affects application behavior (such as by causing excessive memory allocation).
- Record
DEBIAN-CVE-2020-13757- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
Show 17 moreShow less
OSVGHSA-537h-rv9q-vvph
Python-RSA decryption of ciphertext leads to DoS
Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.g., by helping an attacker to infer that an application uses Python-RSA, or if the length of accepted ciphertext affects application behavior (such as by causing excessive memory allocation).
- Record
GHSA-537h-rv9q-vvph- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-327
- Updated
- 2026-11-02
OSVRHSA-2020:3453
Red Hat Security Advisory: OpenShift Container Platform 4.5.6 security update
- Record
RHSA-2020:3453- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2020:3541
Red Hat Security Advisory: OpenShift Container Platform 3.11 security update
- Record
RHSA-2020:3541- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-13757
Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.g., by helping an attacker to infer that an application uses Python-RSA, or if the length of accepted ciphertext affects application behavior (such as by causing excessive memory allocation).
- Record
UBUNTU-CVE-2020-13757- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVMGASA-2020-0364 No score
Updated python-rsa packages fix security vulnerability
Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.g., by helping an attacker to infer that an application uses Python-RSA, or if the length of accepted ciphertext affects application behavior (such as by causing excessive memory allocation). (CVE-2020-13757)
- Record
MGASA-2020-0364- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:0901-1 No score
Security update for python-rsa
This update for python-rsa fixes the following issues:
- CVE-2020-13757: Proper handling of leading '\0' bytes during decryption of ciphertext (bsc#1172389)
This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2021:0901-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:2008-1 No score
Security update for python-rsa
This update for python-rsa fixes the following issues:
- CVE-2020-13757: Proper handling of leading '\0' bytes during decryption of ciphertext (bsc#1172389)
- Record
openSUSE-SU-2021:2008-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11269-1 No score
python36-rsa-4.7.2-1.5 on GA media
These are all security issues fixed in the python36-rsa-4.7.2-1.5 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11269-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14163-1 No score
python310-rsa-4.9-3.5 on GA media
These are all security issues fixed in the python310-rsa-4.9-3.5 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14163-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:12041-1 No score
python313-rsa-4.9.1-1.4 on GA media
These are all security issues fixed in the python313-rsa-4.9.1-1.4 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12041-1- Updated
- 2026-11-02
OSVPYSEC-2020-99 No score
Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.g., by helping an attacker to infer that an application uses Python-RSA, or if the length of accepted ciphertext affects application behavior (such as by causing excessive memory allocation).
- Record
PYSEC-2020-99- Updated
- 2026-11-02
OSVSUSE-SU-2021:2008-1 No score
Security update for python-rsa
This update for python-rsa fixes the following issues:
- CVE-2020-13757: Proper handling of leading '\0' bytes during decryption of ciphertext (bsc#1172389)
- Record
SUSE-SU-2021:2008-1- Updated
- 2026-11-02
OSVSUSE-SU-2021:2237-1 No score
Security update for python-rsa
This update for python-rsa fixes the following issues:
- CVE-2020-13757: Proper handling of leading '\0' bytes during decryption of ciphertext (bsc#1172389)
- Record
SUSE-SU-2021:2237-1- Updated
- 2026-11-02
OSVSUSE-SU-2021:2253-1 No score
Security update for python-rsa
This update for python-rsa fixes the following issues:
- CVE-2020-13757: Proper handling of leading '\0' bytes during decryption of ciphertext (bsc#1172389)
- Record
SUSE-SU-2021:2253-1- Updated
- 2026-11-02
OSVSUSE-SU-2022:3287-1 No score
Security update for python-rsa
This update for python-rsa fixes the following issues:
- CVE-2020-13757: Fixed an issue where leading null bytes in a ciphertext would be ignored during decryption, leading to a potential information leak (bsc#1172389).
- Record
SUSE-SU-2022:3287-1- Updated
- 2026-11-02
OSVUSN-4478-1 No score
python-rsa vulnerability
It was discovered that Python-RSA incorrectly handled certain ciphertexts. An attacker could possibly use this issue to obtain sensitive information.
- Record
USN-4478-1- Updated
- 2026-11-02
OSVUSN-4478-2 No score
python-rsa vulnerability
USN-4478-1 fixed a vulnerability in Python-RSA. This update provides the corresponding update for Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and Ubuntu 20.04 ESM.
Original advisory details:
It was discovered that Python-RSA incorrectly handled certain ciphertexts. An attacker could possibly use this issue to obtain sensitive information.
- Record
USN-4478-2- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
rsaPyPI |
before 4.1 | 4.1 |
python-rsaDebian:12 |
before 4.7.2-1 | 4.7.2-1 |
python-rsaDebian:13 |
before 4.7.2-1 | 4.7.2-1 |
python-rsaDebian:14 |
before 4.7.2-1 | 4.7.2-1 |
rsaPyPI |
before 4.1, plus listed versions 1.11.21.31.3.11.3.2 Show 18 moreShow less1.3.32.03.03.0.13.13.1.13.1.23.1.33.1.43.23.2.13.2.23.2.33.33.43.4.13.4.24.0 |
4.1 |
python-rsaMageia:7 |
before 4.0-1.1.mga7 | 4.0-1.1.mga7 |
jenkins-2-pluginsRed Hat:openshift:4.5::el7 From an advisory covering 6 CVEs |
before 0:4.5.1596698303-1.el7 | 0:4.5.1596698303-1.el7 |
python-rsaRed Hat:openshift:4.5::el7 From an advisory covering 6 CVEs |
before 0:4.5-1.el7 | 0:4.5-1.el7 |
python2-rsaRed Hat:openshift:4.5::el7 From an advisory covering 6 CVEs |
before 0:4.5-1.el7 | 0:4.5-1.el7 |
jenkins-2-pluginsRed Hat:openshift:3.11::el7 From an advisory covering 10 CVEs |
before 0:3.11.1597310986-1.el7 | 0:3.11.1597310986-1.el7 |
Show 38 moreShow less
| Package | Affected | Fixed |
|---|---|---|
openshift-ansibleRed Hat:openshift:3.11::el7 From an advisory covering 10 CVEs |
before 0:3.11.272-1.git.0.79ab6e9.el7 | 0:3.11.272-1.git.0.79ab6e9.el7 |
openshift-ansible-docsRed Hat:openshift:3.11::el7 From an advisory covering 10 CVEs |
before 0:3.11.272-1.git.0.79ab6e9.el7 | 0:3.11.272-1.git.0.79ab6e9.el7 |
openshift-ansible-playbooksRed Hat:openshift:3.11::el7 From an advisory covering 10 CVEs |
before 0:3.11.272-1.git.0.79ab6e9.el7 | 0:3.11.272-1.git.0.79ab6e9.el7 |
openshift-ansible-rolesRed Hat:openshift:3.11::el7 From an advisory covering 10 CVEs |
before 0:3.11.272-1.git.0.79ab6e9.el7 | 0:3.11.272-1.git.0.79ab6e9.el7 |
openshift-ansible-testRed Hat:openshift:3.11::el7 From an advisory covering 10 CVEs |
before 0:3.11.272-1.git.0.79ab6e9.el7 | 0:3.11.272-1.git.0.79ab6e9.el7 |
jenkinsRed Hat:openshift:3.11::el7 From an advisory covering 10 CVEs |
before 0:2.235.2.1597220898-1.el7 | 0:2.235.2.1597220898-1.el7 |
python-rsaRed Hat:openshift:3.11::el7 From an advisory covering 10 CVEs |
before 0:4.5-2.el7 | 0:4.5-2.el7 |
python2-rsaRed Hat:openshift:3.11::el7 From an advisory covering 10 CVEs |
before 0:4.5-2.el7 | 0:4.5-2.el7 |
python-rsaSUSE:Linux Enterprise Module for Basesystem 15 SP2 |
before 3.4.2-3.4.1 | 3.4.2-3.4.1 |
python-rsaSUSE:Linux Enterprise Module for Basesystem 15 SP3 |
before 3.4.2-3.4.1 | 3.4.2-3.4.1 |
python-rsaSUSE:Linux Enterprise Module for Package Hub 15 SP2 |
before 3.4.2-3.4.1 | 3.4.2-3.4.1 |
python-rsaSUSE:Linux Enterprise Module for Package Hub 15 SP3 |
before 3.4.2-3.4.1 | 3.4.2-3.4.1 |
python-rsaSUSE:Linux Enterprise Module for Public Cloud 15 |
before 3.4.2-3.4.1 | 3.4.2-3.4.1 |
python-rsaSUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS |
before 3.4.2-3.4.1 | 3.4.2-3.4.1 |
python-rsaSUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS |
before 3.4.2-3.4.1 | 3.4.2-3.4.1 |
python-rsaSUSE:Linux Enterprise Server 15 SP1-BCL |
before 3.4.2-3.4.1 | 3.4.2-3.4.1 |
python-rsaSUSE:Linux Enterprise Server 15 SP1-LTSS |
before 3.4.2-3.4.1 | 3.4.2-3.4.1 |
python-rsaSUSE:Linux Enterprise Server for SAP Applications 15 SP1 |
before 3.4.2-3.4.1 | 3.4.2-3.4.1 |
python-rsaSUSE:Manager Proxy 4.0 |
before 3.4.2-3.4.1 | 3.4.2-3.4.1 |
python-rsaSUSE:Manager Retail Branch Server 4.0 |
before 3.4.2-3.4.1 | 3.4.2-3.4.1 |
python-rsaSUSE:Manager Server 4.0 |
before 3.4.2-3.4.1 | 3.4.2-3.4.1 |
python-rsaSUSE:Enterprise Storage 6 |
before 3.4.2-3.4.1 | 3.4.2-3.4.1 |
python-rsaSUSE:OpenStack Cloud 7 |
before 3.1.4-12.16.1 | 3.1.4-12.16.1 |
python-rsaSUSE:Linux Enterprise Module for Public Cloud 12 |
before 3.1.4-12.16.1 | 3.1.4-12.16.1 |
python-rsaSUSE:OpenStack Cloud 9 |
before 3.4.2-4.4.1 | 3.4.2-4.4.1 |
python-rsaSUSE:OpenStack Cloud Crowbar 9 |
before 3.4.2-4.4.1 | 3.4.2-4.4.1 |
python-rsaSUSE:HPE Helion OpenStack 8 |
before 3.4.2-3.3.1 | 3.4.2-3.3.1 |
python-rsaSUSE:OpenStack Cloud 8 |
before 3.4.2-3.3.1 | 3.4.2-3.3.1 |
python-rsaSUSE:OpenStack Cloud Crowbar 8 |
before 3.4.2-3.3.1 | 3.4.2-3.3.1 |
python-rsaUbuntu:Pro:14.04:LTS |
before 3.1.2-1ubuntu0.1+esm1, plus listed versions 3.1.2-13.1.2-1ubuntu0.1 |
3.1.2-1ubuntu0.1+esm1 |
python-rsaUbuntu:Pro:16.04:LTS |
before 3.2.3-1.1ubuntu0.1~esm1, plus listed versions 3.1.4-13.2.3-13.2.3-1.1 |
3.2.3-1.1ubuntu0.1~esm1 |
python-rsaUbuntu:Pro:18.04:LTS |
before 3.4.2-1ubuntu0.1~esm1, plus listed versions 3.4.2-1 |
3.4.2-1ubuntu0.1~esm1 |
python-rsaUbuntu:Pro:20.04:LTS |
before 4.0-3ubuntu0.1~esm1, plus listed versions 4.0-24.0-3 |
4.0-3ubuntu0.1~esm1 |
python-rsaopenSUSE:Leap 15.2 |
before 3.4.2-lp152.4.3.1 | 3.4.2-lp152.4.3.1 |
python-rsaopenSUSE:Leap 15.3 |
before 3.4.2-3.4.1 | 3.4.2-3.4.1 |
python-rsaopenSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 4.7.2-1.5 | 4.7.2-1.5 |
python-rsaopenSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 4.9-3.5 | 4.9-3.5 |
python-rsaopenSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 4.9.1-1.4 | 4.9.1-1.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-13757 is a high vulnerability (CVSS 7.5) in Python-rsa Project Python-rsa, published June 1, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.43%, the 73rd percentile. Fixed in rsa 4.1.
References
github.com/sybrenstuvel/python-rsa/issues/146
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2KILTHBHNSDUCYV22ODLOKTICJJ7JQIQ
usn.ubuntu.com/4478-1
nvd.nist.gov/vuln/detail/CVE-2020-13757
Show 74 moreShow less
security-tracker.debian.org/tracker/CVE-2020-13757
advisories.mageia.org/MGASA-2020-0364.html
bugs.mageia.org/show_bug.cgi?id=26954
access.redhat.com/errata/RHSA-2020:3453
bugzilla.redhat.com/show_bug.cgi?id=1848507
security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3453.json
cve.org/CVERecord?id=CVE-2020-2181
jenkins.io/security/advisory/2020-05-06
suse.com/support/update/announcement/2021/suse-su-20212008-1
bugzilla.suse.com/1172389
ubuntu.com/security/CVE-2020-13757
lists.opensuse.org/archives/list/[email protected]/thread/P3ME7Z7HY3RZGMZEXVYWABVMMLGMXE2S