{"id":"CVE-2020-13757","aliases":["DEBIAN-CVE-2020-13757","EUVD-2020-0168","GHSA-537h-rv9q-vvph","MGASA-2020-0364","PYSEC-2020-99","RHSA-2020:3453","RHSA-2020:3541","SUSE-SU-2021:2008-1","SUSE-SU-2021:2237-1","SUSE-SU-2021:2253-1","SUSE-SU-2022:3287-1","UBUNTU-CVE-2020-13757","USN-4478-1","USN-4478-2","openSUSE-SU-2021:0901-1","openSUSE-SU-2021:2008-1","openSUSE-SU-2024:11269-1","openSUSE-SU-2024:14163-1","openSUSE-SU-2026:12041-1"],"status":"published","title":"Python-RSA decryption of ciphertext leads to DoS","description":"Python-RSA before 4.1 ignores leading '\\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.g., by helping an attacker to infer that an application uses Python-RSA, or if the length of accepted ciphertext affects application behavior (such as by causing excessive memory allocation).","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.01421,"percentile":0.73062,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-327"],"published":"2020-06-01T18:17:07Z","modified":"2026-10-26T12:00:33Z","fixes":[{"ecosystem":"PyPI","package":"rsa","fixed_in":["4.1"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"python-rsa","fixed_in":["4.7.2-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"python-rsa","fixed_in":["4.7.2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-rsa","fixed_in":["4.7.2-1"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"python-rsa","fixed_in":["4.0-1.1.mga7"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"python-rsa","fixed_in":["3.4.2-3.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"python-rsa","fixed_in":["3.4.2-3.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP2","package":"python-rsa","fixed_in":["3.4.2-3.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP3","package":"python-rsa","fixed_in":["3.4.2-3.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15","package":"python-rsa","fixed_in":["3.4.2-3.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"python-rsa","fixed_in":["3.4.2-3.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"python-rsa","fixed_in":["3.4.2-3.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"python-rsa","fixed_in":["3.4.2-3.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"python-rsa","fixed_in":["3.4.2-3.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"python-rsa","fixed_in":["3.4.2-3.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.0","package":"python-rsa","fixed_in":["3.4.2-3.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Retail Branch Server 4.0","package":"python-rsa","fixed_in":["3.4.2-3.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.0","package":"python-rsa","fixed_in":["3.4.2-3.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 6","package":"python-rsa","fixed_in":["3.4.2-3.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 7","package":"python-rsa","fixed_in":["3.1.4-12.16.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","package":"python-rsa","fixed_in":["3.1.4-12.16.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 9","package":"python-rsa","fixed_in":["3.4.2-4.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"python-rsa","fixed_in":["3.4.2-4.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:HPE Helion OpenStack 8","package":"python-rsa","fixed_in":["3.4.2-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 8","package":"python-rsa","fixed_in":["3.4.2-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"python-rsa","fixed_in":["3.4.2-3.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"python-rsa","fixed_in":["3.1.2-1ubuntu0.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"python-rsa","fixed_in":["3.2.3-1.1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-rsa","fixed_in":["3.4.2-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python-rsa","fixed_in":["4.0-3ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"python-rsa","fixed_in":["3.4.2-lp152.4.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"python-rsa","fixed_in":["3.4.2-3.4.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"rsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"python-rsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.2-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"python-rsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.2-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"python-rsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.2-1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"rsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1"}]}],"versions":["1.1","1.2","1.3","1.3.1","1.3.2","1.3.3","2.0","3.0","3.0.1","3.1","3.1.1","3.1.2","3.1.3","3.1.4","3.2","3.2.1","3.2.2","3.2.3","3.3","3.4","3.4.1","3.4.2","4.0"]},{"source":"osv","ecosystem":"Mageia:7","package":"python-rsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0-1.1.mga7"}]}]},{"source":"osv","ecosystem":"PyPI","package":"rsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1"}]}],"versions":["1.1","1.2","1.3","1.3.1","1.3.2","1.3.3","2.0","3.0","3.0.1","3.1","3.1.1","3.1.2","3.1.3","3.1.4","3.2","3.2.1","3.2.2","3.2.3","3.3","3.4","3.4.1","3.4.2","4.0"]},{"source":"osv","ecosystem":"Red Hat:openshift:4.5::el7","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.1596698303-1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:4.5::el7","package":"python-rsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5-1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:4.5::el7","package":"python2-rsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5-1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.1597310986-1.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"openshift-ansible","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.272-1.git.0.79ab6e9.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"openshift-ansible-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.272-1.git.0.79ab6e9.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"openshift-ansible-playbooks","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.272-1.git.0.79ab6e9.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"openshift-ansible-roles","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.272-1.git.0.79ab6e9.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"openshift-ansible-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.272-1.git.0.79ab6e9.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"jenkins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.235.2.1597220898-1.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"python-rsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5-2.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"python2-rsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5-2.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"python-rsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-3.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"python-rsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-3.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP2","package":"python-rsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-3.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP3","package":"python-rsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-3.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15","package":"python-rsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-3.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"python-rsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-3.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"python-rsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-3.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"python-rsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-3.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"python-rsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-3.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"python-rsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-3.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.0","package":"python-rsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-3.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.0","package":"python-rsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-3.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.0","package":"python-rsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-3.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"python-rsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-3.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"python-rsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-12.16.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","package":"python-rsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-12.16.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"python-rsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-4.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"python-rsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-4.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"python-rsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"python-rsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"python-rsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-3.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"python-rsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-1ubuntu0.1+esm1"}]}],"versions":["3.1.2-1","3.1.2-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"python-rsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-1.1ubuntu0.1~esm1"}]}],"versions":["3.1.4-1","3.2.3-1","3.2.3-1.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-rsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-1ubuntu0.1~esm1"}]}],"versions":["3.4.2-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"python-rsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-1ubuntu0.1+esm1"}]}],"versions":["3.1.2-1","3.1.2-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"python-rsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-1.1ubuntu0.1~esm1"}]}],"versions":["3.1.4-1","3.2.3-1","3.2.3-1.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-rsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-1ubuntu0.1~esm1"}]}],"versions":["3.4.2-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python-rsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0-3ubuntu0.1~esm1"}]}],"versions":["4.0-2","4.0-3"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"python-rsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-lp152.4.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"python-rsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-3.4.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-rsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.2-1.5"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-rsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9-3.5"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-rsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.1-1.4"}]}],"bundled":2}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"python-rsa_project","product":"python-rsa"}],"references":[{"url":"https://github.com/sybrenstuvel/python-rsa/issues/146","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report","web","article"]},{"url":"https://github.com/sybrenstuvel/python-rsa/issues/146#issuecomment-641845667","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2KILTHBHNSDUCYV22ODLOKTICJJ7JQIQ/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZYB65VNILRBTXL6EITQTH2PZPK7I23MW/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://usn.ubuntu.com/4478-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13757","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/rsa/PYSEC-2020-99.yaml","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2KILTHBHNSDUCYV22ODLOKTICJJ7JQIQ","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZYB65VNILRBTXL6EITQTH2PZPK7I23MW","tags":["web"]},{"url":"https://usn.ubuntu.com/4478-1","tags":["web"]},{"url":"https://github.com/advisories/GHSA-537h-rv9q-vvph","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-13757","tags":["advisory"]},{"url":"https://github.com/sybrenstuvel/python-rsa","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2020-0364.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=26954","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/ZYB65VNILRBTXL6EITQTH2PZPK7I23MW/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2KILTHBHNSDUCYV22ODLOKTICJJ7JQIQ/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZYB65VNILRBTXL6EITQTH2PZPK7I23MW/","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2020:3453","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1848507","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1857436","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1857439","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1857441","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3453.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-2181","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1847341","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-2181","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-2181","tags":["advisory"]},{"url":"https://jenkins.io/security/advisory/2020-05-06/#SECURITY-1374","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-2182","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1847348","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-2182","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-2182","tags":["advisory"]},{"url":"https://jenkins.io/security/advisory/2020-05-06/#SECURITY-1835","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-2224","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-2224","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-2224","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-2225","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-2225","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-2225","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-2226","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-2226","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-2226","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-13757","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-13757","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2020:3541","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1802381","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1819663","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1857425","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1857427","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1857431","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1857433","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3541.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-16541","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-16541","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-16541","tags":["advisory"]},{"url":"https://jenkins.io/security/advisory/2019-11-21/#SECURITY-1106","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-1741","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-1741","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-1741","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-2220","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-2220","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-2220","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-2221","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-2221","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-2221","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-2222","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-2222","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-2222","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-2223","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-2223","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-2223","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212008-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1172389","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13757","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212237-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212253-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223287-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-13757","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4478-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-4478-2","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/P3ME7Z7HY3RZGMZEXVYWABVMMLGMXE2S/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/V4YOO76ZUMWHQXJCEHC2KUOF54N5673X/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25658","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-13757","description":"Python-RSA before 4.1 ignores leading '\\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.g., by helping an attacker to infer that an application uses Python-RSA, or if the length of accepted ciphertext affects application behavior (such as by causing excessive memory allocation).","status":"published","published":"2020-06-01T18:17:07Z","modified":"2024-08-04T12:25:16.505Z","updated_at":"2026-11-02T14:35:53.868619Z"}],"euvd":[{"id":"EUVD-2020-0168","description":"Python-RSA before 4.1 ignores leading '\\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.g., by helping an attacker to infer that an application uses Python-RSA, or if the length of accepted ciphertext affects application behavior (such as by causing excessive memory allocation).","status":"published","published":"2020-06-01T18:17:07Z","modified":"2024-08-04T12:25:16Z","updated_at":"2026-11-03T03:07:37.234427Z"}],"ghsa":[{"id":"GHSA-537h-rv9q-vvph","title":"Python-RSA decryption of ciphertext leads to DoS","description":"Python-RSA before 4.1 ignores leading '\\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.g., by helping an attacker to infer that an application uses Python-RSA, or if the length of accepted ciphertext affects application behavior (such as by causing excessive memory allocation).","status":"published","published":"2021-03-24T18:24:39Z","modified":"2024-10-21T21:54:28Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-327"],"updated_at":"2026-11-02T14:38:12.325695Z"}],"nvd":[{"id":"CVE-2020-13757","description":"Python-RSA before 4.1 ignores leading '\\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.g., by helping an attacker to infer that an application uses Python-RSA, or if the length of accepted ciphertext affects application behavior (such as by causing excessive memory allocation).","status":"published","published":"2020-06-01T19:15:10.067Z","modified":"2026-06-17T02:53:36.237Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-327"],"updated_at":"2026-11-02T14:06:04.922138Z"}],"osv":[{"id":"CVE-2020-13757","description":"Python-RSA before 4.1 ignores leading '\\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.g., by helping an attacker to infer that an application uses Python-RSA, or if the length of accepted ciphertext affects application behavior (such as by causing excessive memory allocation).","status":"published","published":"2020-06-01T19:15:10.067Z","modified":"2026-10-20T10:51:48.140966581Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:14.418339Z"},{"id":"DEBIAN-CVE-2020-13757","description":"Python-RSA before 4.1 ignores leading '\\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.g., by helping an attacker to infer that an application uses Python-RSA, or if the length of accepted ciphertext affects application behavior (such as by causing excessive memory allocation).","status":"published","published":"2020-06-01T19:15:10.067Z","modified":"2026-10-26T12:00:33.919293448Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:32.862554Z"},{"id":"GHSA-537h-rv9q-vvph","title":"Python-RSA decryption of ciphertext leads to DoS","description":"Python-RSA before 4.1 ignores leading '\\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.g., by helping an attacker to infer that an application uses Python-RSA, or if the length of accepted ciphertext affects application behavior (such as by causing excessive memory allocation).","status":"published","published":"2021-03-24T18:24:39Z","modified":"2024-10-21T22:00:53.647822Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-327"],"updated_at":"2026-11-02T15:46:37.864461Z"},{"id":"RHSA-2020:3453","title":"Red Hat Security Advisory: OpenShift Container Platform 4.5.6 security update","status":"published","published":"2024-09-16T04:40:56Z","modified":"2026-06-28T10:38:52Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"RHSA-2020:3541","title":"Red Hat Security Advisory: OpenShift Container Platform 3.11 security update","status":"published","published":"2024-09-16T04:42:09Z","modified":"2026-08-08T10:01:49Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.57369Z"},{"id":"UBUNTU-CVE-2020-13757","description":"Python-RSA before 4.1 ignores leading '\\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.g., by helping an attacker to infer that an application uses Python-RSA, or if the length of accepted ciphertext affects application behavior (such as by causing excessive memory allocation).","status":"published","published":"2020-06-01T19:15:00Z","modified":"2026-02-04T04:11:56.809642Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:22.804634Z"},{"id":"MGASA-2020-0364","title":"Updated python-rsa packages fix security vulnerability","description":"Python-RSA before 4.1 ignores leading '\\0' bytes during decryption of\nciphertext. This could conceivably have a security-relevant impact, e.g.,\nby helping an attacker to infer that an application uses Python-RSA, or if\nthe length of accepted ciphertext affects application behavior (such as by\ncausing excessive memory allocation). (CVE-2020-13757)\n","status":"published","published":"2020-09-06T20:33:09Z","modified":"2026-04-16T04:42:35.913845173Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"openSUSE-SU-2021:0901-1","title":"Security update for python-rsa","description":"This update for python-rsa fixes the following issues:\n\n- CVE-2020-13757: Proper handling of leading '\\0' bytes during decryption of ciphertext (bsc#1172389)\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2021-06-23T16:23:29Z","modified":"2026-02-04T02:43:57.13688Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2021:2008-1","title":"Security update for python-rsa","description":"This update for python-rsa fixes the following issues:\n\n- CVE-2020-13757: Proper handling of leading '\\0' bytes during decryption of ciphertext (bsc#1172389)\n","status":"published","published":"2021-07-11T09:16:12Z","modified":"2025-05-07T18:11:26.860392Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2024:11269-1","title":"python36-rsa-4.7.2-1.5 on GA media","description":"These are all security issues fixed in the python36-rsa-4.7.2-1.5 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:16:22.748236Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"openSUSE-SU-2024:14163-1","title":"python310-rsa-4.9-3.5 on GA media","description":"These are all security issues fixed in the python310-rsa-4.9-3.5 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-07-12T00:00:00Z","modified":"2026-02-04T02:18:43.135362Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2026:12041-1","title":"python313-rsa-4.9.1-1.4 on GA media","description":"These are all security issues fixed in the python313-rsa-4.9.1-1.4 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-04T00:00:00Z","modified":"2026-10-05T10:15:52.240891345Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"PYSEC-2020-99","description":"Python-RSA before 4.1 ignores leading '\\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.g., by helping an attacker to infer that an application uses Python-RSA, or if the length of accepted ciphertext affects application behavior (such as by causing excessive memory allocation).","status":"published","published":"2020-06-01T19:15:00Z","modified":"2023-11-08T04:02:21.687509Z","updated_at":"2026-11-02T15:52:52.682031Z"},{"id":"SUSE-SU-2021:2008-1","title":"Security update for python-rsa","description":"This update for python-rsa fixes the following issues:\n\n- CVE-2020-13757: Proper handling of leading '\\0' bytes during decryption of ciphertext (bsc#1172389)\n","status":"published","published":"2021-06-17T16:08:35Z","modified":"2026-02-04T03:38:48.853252Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:2237-1","title":"Security update for python-rsa","description":"This update for python-rsa fixes the following issues:\n\n- CVE-2020-13757: Proper handling of leading '\\0' bytes during decryption of ciphertext (bsc#1172389)\n","status":"published","published":"2021-07-02T15:25:10Z","modified":"2026-02-04T03:04:19.974854Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:2253-1","title":"Security update for python-rsa","description":"This update for python-rsa fixes the following issues:\n\n- CVE-2020-13757: Proper handling of leading '\\0' bytes during decryption of ciphertext (bsc#1172389)\n","status":"published","published":"2021-07-06T07:03:40Z","modified":"2025-05-02T04:30:28.703017Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2022:3287-1","title":"Security update for python-rsa","description":"This update for python-rsa fixes the following issues:\n\n- CVE-2020-13757: Fixed an issue where leading null bytes in a\n  ciphertext would be ignored during decryption, leading to a\n  potential information leak (bsc#1172389).\n","status":"published","published":"2022-09-16T08:19:23Z","modified":"2026-02-04T04:10:35.76744Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"USN-4478-1","title":"python-rsa vulnerability","description":"It was discovered that Python-RSA incorrectly handled certain ciphertexts.\nAn attacker could possibly use this issue to obtain sensitive information.\n","status":"published","published":"2020-08-31T17:48:35Z","modified":"2026-02-10T04:41:54Z","updated_at":"2026-11-02T16:58:14.547547Z"},{"id":"USN-4478-2","title":"python-rsa vulnerability","description":"USN-4478-1 fixed a vulnerability in Python-RSA.\nThis update provides the corresponding update for Ubuntu 16.04 ESM,\nUbuntu 18.04 ESM and Ubuntu 20.04 ESM.\n\nOriginal advisory details:\n\n It was discovered that Python-RSA incorrectly handled certain ciphertexts.\n An attacker could possibly use this issue to obtain sensitive information.\n","status":"published","published":"2022-02-21T17:25:41Z","modified":"2026-06-25T13:30:19.763458529Z","updated_at":"2026-11-02T16:58:14.547547Z"}]}}