{"id":"CVE-2023-50782","aliases":["AZL-34309","AZL-35129","BELL-CVE-2023-50782","CLSA-2025-1759968827","CLSA-2026-1772151042","CLSA-2026-1788167137","DEBIAN-CVE-2023-50782","EUVD-2024-0496","GHSA-3ww4-gg4f-jr7f","MGASA-2025-0069","OESA-2025-1774","OESA-2025-1775","OESA-2025-1776","OESA-2025-1863","OESA-2025-1864","OESA-2025-1865","PYSEC-2026-1283","ROOT-APP-PYPI-CVE-2023-50782","SUSE-SU-2024:3757-1","SUSE-SU-2024:3765-1","SUSE-SU-2024:3766-1","SUSE-SU-2024:3871-1","SUSE-SU-2024:3872-1","SUSE-SU-2024:3904-1","SUSE-SU-2024:3905-1","SUSE-SU-2024:3943-1","SUSE-SU-2025:20081-1","SUSE-SU-2025:20593-1","UBUNTU-CVE-2023-50782","USN-6673-1","USN-6673-2","openSUSE-SU-2024:14416-1"],"status":"published","title":"Python-cryptography: bleichenbacher timing oracle attack against rsa decryption - incomplete fix for cve-2020-25659","description":"A flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.01118,"percentile":0.6659,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-203","CWE-208","CWE-385"],"published":"2023-12-14T05:57:16.367596Z","modified":"2026-10-28T02:30:37Z","fixes":[{"ecosystem":"PyPI","package":"cryptography","fixed_in":["42.0.0"],"sources":["ghsa","osv"]},{"ecosystem":"Azure Linux:2","package":"python-cryptography","fixed_in":["3.3.2-7"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"python-cryptography","fixed_in":["42.0.5-1"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"openssl","fixed_in":["3.0.12-r5"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"openssl","fixed_in":["3.1.5-r6"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:23","package":"openssl","fixed_in":["3.0.12-r5"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"openssl","fixed_in":["3.1.5-r6"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"python-cryptography","fixed_in":["42.0.5-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-cryptography","fixed_in":["42.0.5-1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"python-cryptography","fixed_in":["3.3.1-6.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"python-cryptography","fixed_in":["36.0.1-7.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"python-cryptography","fixed_in":["42.0.2-8.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"python-cryptography","fixed_in":["36.0.1-8.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"python-cryptography","fixed_in":["42.0.2-8.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP2","package":"python-cryptography","fixed_in":["42.0.2-8.oe2403sp2"],"sources":["osv"]},{"ecosystem":"Root:PyPI","package":"cryptography","fixed_in":["36.0.1+aikido.7","41.0.3+aikido.3","41.0.4+aikido.1","36.0.1+aikido.2","36.0.1+aikido.3","36.0.1+aikido.4","36.0.1+aikido.5","36.0.1+aikido.6","41.0.3+aikido.2","41.0.3+aikido.4","41.0.4+aikido.2","36.0.1+aikido.8"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"openssl-1_1","fixed_in":["1.1.1d-2.113.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"openssl-1_1","fixed_in":["1.1.1d-2.113.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"openssl-1_1","fixed_in":["1.1.1l-150500.17.37.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"openssl-1_1","fixed_in":["1.1.1l-150500.17.37.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap Micro 5.5","package":"openssl-1_1","fixed_in":["1.1.1l-150500.17.37.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"openssl-1_1","fixed_in":["1.1.1l-150500.17.37.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"openssl-1_1","fixed_in":["1.1.1l-150400.7.75.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"openssl-1_1","fixed_in":["1.1.1l-150400.7.75.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"openssl-1_1","fixed_in":["1.1.1l-150400.7.75.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"openssl-1_1","fixed_in":["1.1.1l-150400.7.75.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"openssl-1_1","fixed_in":["1.1.1l-150400.7.75.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"openssl-1_1","fixed_in":["1.1.1l-150400.7.75.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.3","package":"openssl-1_1","fixed_in":["1.1.1l-150400.7.75.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"openssl-1_1","fixed_in":["1.1.1d-150200.11.97.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"openssl-1_1","fixed_in":["1.1.1d-150200.11.97.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"openssl-1_1","fixed_in":["1.1.1d-150200.11.97.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"openssl-1_1","fixed_in":["1.1.1d-150200.11.97.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"openssl-1_1","fixed_in":["1.1.1d-150200.11.97.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"openssl-1_1","fixed_in":["1.1.1d-150200.11.97.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"openssl-1_1","fixed_in":["1.1.1d-150200.11.97.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"openssl-1_1","fixed_in":["1.1.1d-150200.11.97.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7.1","package":"openssl-1_1","fixed_in":["1.1.1d-150200.11.97.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"openssl-1_1","fixed_in":["1.1.1w-150600.5.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP6","package":"openssl-1_1","fixed_in":["1.1.1w-150600.5.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP6","package":"openssl-1_1","fixed_in":["1.1.1w-150600.5.9.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"openssl-1_1","fixed_in":["1.1.1w-150600.5.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"openssl-3","fixed_in":["3.1.4-150600.5.21.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"openssl-3","fixed_in":["3.1.4-150600.5.21.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.1","package":"openssl-3","fixed_in":["3.1.4-slfo.1.1_6.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"python-cryptography","fixed_in":["1.2.3-1ubuntu0.3+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-cryptography","fixed_in":["2.1.4-1ubuntu1.4+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"python-cryptography","fixed_in":["2.8-3ubuntu0.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"python-cryptography","fixed_in":["3.4.8-1ubuntu2.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.0.0"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"python-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.2-7"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"python-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.0.5-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.8-r4"},{"fixed":"3.0.12-r5"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.1-r1"},{"fixed":"3.1.5-r6"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:23","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.8-r4"},{"fixed":"3.0.12-r5"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.1-r1"},{"fixed":"3.1.5-r6"}]}]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"41.0.7"},{"fixed":"41.0.7.post1+tuxcare"}]}],"versions":["41.0.7"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.8"},{"fixed":"3.4.8.post1+tuxcare"}]}],"versions":["3.4.8"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"python-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.4-1ubuntu1.4+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"python-cryptography-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.4-1ubuntu1.4+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"python3-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.4-1ubuntu1.4+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"python-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["38.0.4-3","38.0.4-3+deb12u1","38.0.4-4","41.0.7-1","41.0.7-2","41.0.7-3","41.0.7-4","41.0.7-5","42.0.5-1","42.0.5-2","43.0.0-1","43.0.0-2","43.0.0-3","44.0.2-1","44.0.2-2","45.0.6-1","45.0.6-1~exp1","45.0.7-1","46.0.1-1","46.0.1-1~exp1","46.0.5-1","46.0.5-2","46.0.6-1","46.0.7-1","47.0.0-1","49.0.0-1","49.0.0-1~exp1","49.0.0-2","50.0.2-1~exp1"]},{"source":"osv","ecosystem":"Debian:13","package":"python-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.0.5-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"python-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.0.5-1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.0.0"}]}],"versions":["0.1","0.2","0.2.1","0.2.2","0.3","0.4","0.5","0.5.1","0.5.2","0.5.3","0.5.4","0.6","0.6.1","0.7","0.7.1","0.7.2","0.8","0.8.1","0.8.2","0.9","0.9.1","0.9.2","0.9.3","1.0","1.0.1","1.0.2","1.1","1.1.1","1.1.2","1.2","1.2.1","1.2.2","1.2.3","1.3","1.3.1","1.3.2","1.3.3","1.3.4","1.4","1.5","1.5.1","1.5.2","1.5.3","1.6","1.7","1.7.1","1.7.2","1.8","1.8.1","1.8.2","1.9","2.0","2.0.1","2.0.2","2.0.3","2.1","2.1.1","2.1.2","2.1.3","2.1.4","2.2","2.2.1","2.2.2","2.3","2.3.1","2.4","2.4.1","2.4.2","2.5","2.6","2.6.1","2.7","2.8","2.9","2.9.1","2.9.2","3.0","3.1","3.1.1","3.2","3.2.1","3.3","3.3.1","3.3.2","3.4","3.4.1","3.4.2","3.4.3","3.4.4","3.4.5","3.4.6","3.4.7","3.4.8","35.0.0","36.0.0","36.0.1","36.0.2","37.0.0","37.0.1","37.0.2","37.0.3","37.0.4","38.0.0","38.0.1","38.0.2","38.0.3","38.0.4","39.0.0","39.0.1","39.0.2","40.0.0","40.0.1","40.0.2","41.0.0","41.0.1","41.0.2","41.0.3","41.0.4","41.0.5","41.0.6","41.0.7"]},{"source":"osv","ecosystem":"Mageia:9","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.15-1.3.mga9"}]}],"bundled":3},{"source":"osv","ecosystem":"Mageia:9","package":"python-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"39.0.1-1.1.mga9"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"python-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.1-6.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"python-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"36.0.1-7.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"python-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.0.2-8.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"python-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"36.0.1-8.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"python-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.0.2-8.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"python-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.0.2-8.oe2403sp2"}]}]},{"source":"osv","ecosystem":"PyPI","package":"cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.0.0"}]}],"versions":["0.1","0.2","0.2.1","0.2.2","0.3","0.4","0.5","0.5.1","0.5.2","0.5.3","0.5.4","0.6","0.6.1","0.7","0.7.1","0.7.2","0.8","0.8.1","0.8.2","0.9","0.9.1","0.9.2","0.9.3","1.0","1.0.1","1.0.2","1.1","1.1.1","1.1.2","1.2","1.2.1","1.2.2","1.2.3","1.3","1.3.1","1.3.2","1.3.3","1.3.4","1.4","1.5","1.5.1","1.5.2","1.5.3","1.6","1.7","1.7.1","1.7.2","1.8","1.8.1","1.8.2","1.9","2.0","2.0.1","2.0.2","2.0.3","2.1","2.1.1","2.1.2","2.1.3","2.1.4","2.2","2.2.1","2.2.2","2.3","2.3.1","2.4","2.4.1","2.4.2","2.5","2.6","2.6.1","2.7","2.8","2.9","2.9.1","2.9.2","3.0","3.1","3.1.1","3.2","3.2.1","3.3","3.3.1","3.3.2","3.4","3.4.1","3.4.2","3.4.3","3.4.4","3.4.5","3.4.6","3.4.7","3.4.8","35.0.0","36.0.0","36.0.1","36.0.2","37.0.0","37.0.1","37.0.2","37.0.3","37.0.4","38.0.0","38.0.1","38.0.2","38.0.3","38.0.4","39.0.0","39.0.1","39.0.2","40.0.0","40.0.1","40.0.2","41.0.0","41.0.1","41.0.2","41.0.3","41.0.4","41.0.5","41.0.6","41.0.7"]},{"source":"osv","ecosystem":"Root:PyPI","package":"cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"36.0.1+aikido.7"},{"fixed":"41.0.3+aikido.3"},{"fixed":"41.0.4+aikido.1"},{"fixed":"36.0.1+aikido.2"},{"fixed":"36.0.1+aikido.3"},{"fixed":"36.0.1+aikido.4"},{"fixed":"36.0.1+aikido.5"},{"fixed":"36.0.1+aikido.6"},{"fixed":"41.0.3+aikido.2"},{"fixed":"41.0.3+aikido.4"},{"fixed":"41.0.4+aikido.2"},{"fixed":"36.0.1+aikido.8"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1d-2.113.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1d-2.113.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1l-150500.17.37.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1l-150500.17.37.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.5","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1l-150500.17.37.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1l-150500.17.37.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150500.5.48.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150500.5.48.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150400.4.69.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150400.4.69.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150400.4.69.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150400.4.69.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1l-150400.7.75.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1l-150400.7.75.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1l-150400.7.75.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1l-150400.7.75.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1l-150400.7.75.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1l-150400.7.75.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1l-150400.7.75.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1d-150200.11.97.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1d-150200.11.97.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1d-150200.11.97.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1d-150200.11.97.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1d-150200.11.97.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1d-150200.11.97.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1d-150200.11.97.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1d-150200.11.97.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1d-150200.11.97.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1w-150600.5.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP6","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1w-150600.5.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP6","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1w-150600.5.9.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1w-150600.5.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-150600.5.21.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-150600.5.21.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-slfo.1.1_6.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"python-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-1ubuntu0.3+esm1"}]}],"versions":["1.0.1-1ubuntu1","1.0.2-1","1.1-1","1.1.1-1","1.1.1-1ubuntu1","1.1.1-1ubuntu2","1.1.1-1ubuntu3","1.2.2-2","1.2.3-1","1.2.3-1ubuntu0.1","1.2.3-1ubuntu0.2","1.2.3-1ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.4-1ubuntu1.4+esm1"}]}],"versions":["1.9-1","2.1.3-3","2.1.4-1","2.1.4-1build1","2.1.4-1build2","2.1.4-1ubuntu1","2.1.4-1ubuntu1.1","2.1.4-1ubuntu1.2","2.1.4-1ubuntu1.3","2.1.4-1ubuntu1.4"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"python-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8-3ubuntu0.3"}]}],"versions":["2.6.1-3.1","2.6.1-4","2.6.1-4ubuntu1","2.8-1ubuntu2","2.8-2","2.8-3","2.8-3ubuntu0.1","2.8-3ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"python-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.8-1ubuntu2.2"}]}],"versions":["3.3.2-1","3.3.2-1build1","3.4.8-1","3.4.8-1ubuntu1","3.4.8-1ubuntu2","3.4.8-1ubuntu2.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.4-1ubuntu1.4+esm1"}]}],"versions":["1.9-1","2.1.3-3","2.1.4-1","2.1.4-1build1","2.1.4-1build2","2.1.4-1ubuntu1","2.1.4-1ubuntu1.1","2.1.4-1ubuntu1.2","2.1.4-1ubuntu1.3","2.1.4-1ubuntu1.4"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"python-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8-3ubuntu0.3"}]}],"versions":["2.6.1-3.1","2.6.1-4","2.6.1-4ubuntu1","2.8-1ubuntu2","2.8-2","2.8-3","2.8-3ubuntu0.1","2.8-3ubuntu0.2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"python-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.8-1ubuntu2.2"}]}],"versions":["3.3.2-1","3.3.2-1build1","3.4.8-1","3.4.8-1ubuntu1","3.4.8-1ubuntu2","3.4.8-1ubuntu2.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"python-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-1ubuntu0.3+esm1"}]}],"versions":["1.0.1-1ubuntu1","1.0.2-1","1.1-1","1.1.1-1","1.1.1-1ubuntu1","1.1.1-1ubuntu2","1.1.1-1ubuntu3","1.2.2-2","1.2.3-1","1.2.3-1ubuntu0.1","1.2.3-1ubuntu0.2","1.2.3-1ubuntu0.3"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-15.1"}]}],"bundled":2}],"products":[{"vendor":"couchbase","product":"couchbase_server"},{"vendor":"cryptography.io","product":"cryptography"},{"vendor":"red hat","product":"red hat ansible automation platform 2"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat satellite 6"},{"vendor":"red hat","product":"red hat update infrastructure 4 for cloud providers"},{"vendor":"redhat","product":"ansible_automation_platform"},{"vendor":"redhat","product":"enterprise_linux"},{"vendor":"redhat","product":"update_infrastructure"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2023-50782","tags":["vdb-entry","x_refsource_REDHAT","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2254432","tags":["issue-tracking","x_refsource_REDHAT","x_transferred","Issue Tracking","Vendor Advisory","report","web"]},{"url":"https://www.couchbase.com/alerts/","tags":["x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-50782","tags":["web","advisory"]},{"url":"https://github.com/pyca/cryptography/issues/9785","tags":["web","report"]},{"url":"https://www.couchbase.com/alerts","tags":["web"]},{"url":"https://github.com/advisories/GHSA-3ww4-gg4f-jr7f","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2023-50782","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1788167137.html","tags":["advisory"]},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/50xxx/CVE-2023-50782.json","tags":["advisory"]},{"url":"https://github.com/pyca/cryptography","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-50782","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2025-0069.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=32584","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2023/11/29/2","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-6673-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-6673-3","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1774","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1775","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1776","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1863","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1864","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1865","tags":["advisory"]},{"url":"https://pypi.org/project/cryptography","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243757-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1220262","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-50782","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243765-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243766-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1230698","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41996","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243871-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243872-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243904-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243905-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1224258","tags":["report"]},{"url":"https://bugzilla.suse.com/1224260","tags":["report"]},{"url":"https://bugzilla.suse.com/1224264","tags":["report"]},{"url":"https://bugzilla.suse.com/1224265","tags":["report"]},{"url":"https://bugzilla.suse.com/1224266","tags":["report"]},{"url":"https://bugzilla.suse.com/1224267","tags":["report"]},{"url":"https://bugzilla.suse.com/1224268","tags":["report"]},{"url":"https://bugzilla.suse.com/1224269","tags":["report"]},{"url":"https://bugzilla.suse.com/1224270","tags":["report"]},{"url":"https://bugzilla.suse.com/1224271","tags":["report"]},{"url":"https://bugzilla.suse.com/1224272","tags":["report"]},{"url":"https://bugzilla.suse.com/1224273","tags":["report"]},{"url":"https://bugzilla.suse.com/1224275","tags":["report"]},{"url":"https://bugzilla.suse.com/1228618","tags":["report"]},{"url":"https://bugzilla.suse.com/1228619","tags":["report"]},{"url":"https://bugzilla.suse.com/1228623","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243943-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520081-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520593-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-50782","tags":["report"]},{"url":"https://people.redhat.com/~hkario/marvin/","tags":["report"]},{"url":"https://github.com/openssl/openssl/pull/13817","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6663-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-6673-2","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-50782","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26130","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ZAEWAWTQ662APXDOVFSO6WSPPJ73EELU/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9143","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2023-50782","title":"Python-cryptography: bleichenbacher timing oracle attack against rsa decryption - incomplete fix for cve-2020-25659","description":"A flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data.","status":"published","published":"2024-02-05T20:45:49.705Z","modified":"2026-03-24T11:28:21.353Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-203"],"updated_at":"2026-11-02T14:35:34.923818Z"}],"euvd":[{"id":"EUVD-2024-0496","description":"A flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data.","status":"published","published":"2024-02-05T20:45:49Z","modified":"2026-03-24T11:28:21Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T19:25:30.317985Z"}],"ghsa":[{"id":"GHSA-3ww4-gg4f-jr7f","title":"Python Cryptography package vulnerable to Bleichenbacher timing oracle attack","description":"A flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data.","status":"published","published":"2024-02-05T21:30:31Z","modified":"2026-03-25T05:05:55Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-203","CWE-208","CWE-385"],"updated_at":"2026-11-02T14:39:41.724707Z"}],"nvd":[{"id":"CVE-2023-50782","description":"A flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data.","status":"published","published":"2024-02-05T21:15:11.183Z","modified":"2026-06-17T06:39:58.24Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-203"],"updated_at":"2026-11-02T14:09:04.527564Z"}],"osv":[{"id":"AZL-34309","title":"CVE-2023-50782 affecting package python-cryptography for versions less than 3.3.2-7","description":"A flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data.","status":"published","published":"2024-02-05T21:15:11Z","modified":"2026-04-21T04:27:05.884879Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:03.821827Z"},{"id":"AZL-35129","title":"CVE-2023-50782 affecting package python-cryptography for versions less than 42.0.5-1","description":"A flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data.","status":"published","published":"2024-02-05T21:15:11Z","modified":"2026-04-21T04:52:26.91601Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:04.173658Z"},{"id":"BELL-CVE-2023-50782","status":"published","published":"2023-12-14T05:57:16.367596Z","modified":"2026-01-26T09:36:46.931959Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:18.192656Z"},{"id":"CVE-2023-50782","title":"Python-cryptography: bleichenbacher timing oracle attack against rsa decryption - incomplete fix for cve-2020-25659","description":"A flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data.","status":"published","published":"2024-02-05T20:45:49.705Z","modified":"2026-10-28T02:30:37.14739259Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-203"],"updated_at":"2026-11-02T15:44:35.245372Z"},{"id":"DEBIAN-CVE-2023-50782","description":"A flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data.","status":"published","published":"2024-02-05T21:15:11.183Z","modified":"2026-10-26T18:03:07.248511132Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:40.586408Z"},{"id":"GHSA-3ww4-gg4f-jr7f","title":"Python Cryptography package vulnerable to Bleichenbacher timing oracle attack","description":"A flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data.","status":"published","published":"2024-02-05T21:30:31Z","modified":"2026-09-10T03:50:05.279171645Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-203","CWE-208","CWE-385"],"updated_at":"2026-11-02T15:46:36.092962Z"},{"id":"OESA-2025-1774","title":"python-cryptography security update","description":"cryptography is a package designed to expose cryptographic primitives and recipes to Python developers.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data.(CVE-2023-50782)","status":"published","published":"2025-07-11T11:08:51Z","modified":"2026-08-18T01:18:52.793777739Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-1775","title":"python-cryptography security update","description":"cryptography is a package designed to expose cryptographic primitives and recipes to Python developers.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data.(CVE-2023-50782)","status":"published","published":"2025-07-11T11:08:51Z","modified":"2026-08-18T01:18:52.656788671Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-1776","title":"python-cryptography security update","description":"cryptography is a package designed to expose cryptographic primitives and recipes to Python developers.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data.(CVE-2023-50782)","status":"published","published":"2025-07-11T11:08:51Z","modified":"2026-08-18T01:18:52.819885365Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-1863","title":"python-cryptography security update","description":"cryptography is a package designed to expose cryptographic primitives and recipes to Python developers.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data.(CVE-2023-50782)","status":"published","published":"2025-07-18T11:08:56Z","modified":"2026-08-18T01:18:54.437091275Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-1864","title":"python-cryptography security update","description":"cryptography is a package designed to expose cryptographic primitives and recipes to Python developers.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data.(CVE-2023-50782)","status":"published","published":"2025-07-18T11:08:57Z","modified":"2026-08-18T01:18:54.479724198Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-1865","title":"python-cryptography security update","description":"cryptography is a package designed to expose cryptographic primitives and recipes to Python developers.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data.(CVE-2023-50782)","status":"published","published":"2025-07-18T11:08:57Z","modified":"2026-08-18T01:18:54.287661684Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"PYSEC-2026-1283","title":"Python Cryptography package vulnerable to Bleichenbacher timing oracle attack","description":"A flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data.","status":"published","published":"2026-07-07T11:45:32.057431Z","modified":"2026-07-07T17:47:34.768177954Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:52:54.622769Z"},{"id":"ROOT-APP-PYPI-CVE-2023-50782","title":"CVE-2023-50782 in cryptography - Patched by Root","description":"Root has patched CVE-2023-50782 in the cryptography package for Root:PyPI. Multiple fixed versions available.","status":"published","published":"2026-10-06T02:34:45Z","modified":"2026-10-06T03:15:03.944924421Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:27.940619Z"},{"id":"UBUNTU-CVE-2023-50782","description":"A flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data.","status":"published","published":"2024-02-05T21:15:00Z","modified":"2026-02-04T03:12:52.101374Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T16:54:23.935133Z"},{"id":"CLSA-2025-1759968827","title":"TuxCare security update for cryptography (2 CVEs)","description":"TuxCare rebuilt cryptography to address 2 CVEs. Fixed in 41.0.7.post1+tuxcare.","status":"published","published":"2026-08-04T14:52:10Z","modified":"2026-10-20T13:45:22.683324372Z","updated_at":"2026-11-02T15:43:42.427288Z"},{"id":"CLSA-2026-1772151042","title":"TuxCare security update for cryptography (2 CVEs)","description":"TuxCare rebuilt cryptography to address 2 CVEs. Fixed in 3.4.8.post1+tuxcare.","status":"published","published":"2026-08-04T14:52:08Z","modified":"2026-10-15T09:47:58.730336944Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"CLSA-2026-1788167137","title":"Fix CVE(s): CVE-2023-50782","description":"   * SECURITY UPDATE: Bleichenbacher/Marvin timing oracle in RSA PKCS#1 v1.5\n     decryption. Distinguishing a padding failure from a successful\n     decryption, by error or by plaintext length, lets an attacker with\n     chosen ciphertexts recover the plaintext of an intercepted message.\n     This is the incomplete-fix follow-up to CVE-2020-25659.\n     - debian/patches/CVE-2023-50782.patch: expose\n       Cryptography_HAS_IMPLICIT_RSA_REJECTION from the linked OpenSSL\n       headers in src/_cffi_src/openssl/rsa.py, and skip the PKCS1v15\n       padding-error assertion when that OpenSSL implicitly rejects invalid\n       padding, in tests/hazmat/primitives/test_rsa.py.\n     - The behaviour that closes the oracle comes from OpenSSL implicit\n       rejection (LP: #2054090); built against an OpenSSL without it the\n       constant compiles as 0 and this package behaves as before.\n     - CVE-2023-50782\n   * Build fix: call email.utils.parseaddr with strict=False in\n     src/cryptography/x509/general_name.py. The ELS python2.7 and python3.6\n     carry CVE-2023-27043.patch, whose strict parser guards on\n     isinstance(addr, str); on Python 2 that is bytes, so every unicode\n     argument yields ('', '') and RFC822Name rejects valid addresses, which\n     breaks collection of the package test suite.\n     - debian/patches/fix-parseaddr-call.patch: same workaround the\n       centos7els branch of this package already carries.","status":"published","published":"2026-08-31T09:05:48Z","modified":"2026-10-26T09:43:11.318148228Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"MGASA-2025-0069","title":"Updated python-cryptography \u0026 openssl packages fix security vulnerabilities","description":"Cryptography vulnerable to NULL-dereference when loading PKCS7\ncertificates. (CVE-2023-49083)\nPython-cryptography: bleichenbacher timing oracle attack against rsa\ndecryption - incomplete fix for cve-2020-25659. (CVE-2023-50782)\nCryptography NULL pointer deference with\npkcs12.serialize_key_and_certificates when called with a non-matching\ncertificate and private key and an hmac_hash override. (CVE-2024-26130)\n","status":"published","published":"2025-02-17T18:37:36Z","modified":"2026-04-16T04:43:07.94365081Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2024:14416-1","title":"libopenssl-3-devel-3.1.4-15.1 on GA media","description":"These are all security issues fixed in the libopenssl-3-devel-3.1.4-15.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-10-20T00:00:00Z","modified":"2026-02-04T02:28:40.244543Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"SUSE-SU-2024:3757-1","title":"Security update for openssl-1_1","description":"This update for openssl-1_1 fixes the following issues:\n\n- CVE-2023-50782: Implicit rejection in PKCS#1 v1.5 (bsc#1220262)\n","status":"published","published":"2024-10-25T10:30:29Z","modified":"2026-02-04T04:00:20.206142Z","updated_at":"2026-11-02T15:53:55.639015Z"},{"id":"SUSE-SU-2024:3765-1","title":"Security update for openssl-1_1","description":"This update for openssl-1_1 fixes the following issues:\n\n- CVE-2023-50782: Implicit rejection in PKCS#1 v1.5 (bsc#1220262)\n","status":"published","published":"2024-10-29T01:34:06Z","modified":"2026-02-04T02:58:21.21867Z","updated_at":"2026-11-02T15:53:55.639015Z"},{"id":"SUSE-SU-2024:3766-1","title":"Security update for openssl-3","description":"This update for openssl-3 fixes the following issues:\n\n- CVE-2023-50782: Implicit rejection in PKCS#1 v1.5 (bsc#1220262)\n- CVE-2024-41996: Avoid expensive public key validation for known safe-prime groups (DHEATATTACK) (bsc#1230698)\n","status":"published","published":"2024-10-29T01:34:29Z","modified":"2026-02-04T02:18:56.367414Z","updated_at":"2026-11-02T15:53:55.639015Z"},{"id":"SUSE-SU-2024:3871-1","title":"Security update for openssl-3","description":"This update for openssl-3 fixes the following issues:\n\n- CVE-2023-50782: Implicit rejection in PKCS#1 v1.5 (bsc#1220262)\n- CVE-2024-41996: Avoid expensive public key validation for known safe-prime groups (DHEATATTACK) (bsc#1230698)\n","status":"published","published":"2024-11-01T15:20:04Z","modified":"2026-02-04T03:00:57.74217Z","updated_at":"2026-11-02T15:53:55.639015Z"},{"id":"SUSE-SU-2024:3872-1","title":"Security update for openssl-1_1","description":"This update for openssl-1_1 fixes the following issues:\n\n- CVE-2023-50782: Implicit rejection in PKCS#1 v1.5 (bsc#1220262)\n","status":"published","published":"2024-11-01T15:20:58Z","modified":"2026-02-04T02:52:02.422518Z","updated_at":"2026-11-02T15:53:55.639015Z"},{"id":"SUSE-SU-2024:3904-1","title":"Security update for openssl-1_1","description":"This update for openssl-1_1 fixes the following issues:\n\n- CVE-2023-50782: Implicit rejection in PKCS#1 v1.5 (bsc#1220262)\n","status":"published","published":"2024-11-04T12:38:42Z","modified":"2026-02-04T04:06:07.698132Z","updated_at":"2026-11-02T15:53:55.639015Z"},{"id":"SUSE-SU-2024:3905-1","title":"Security update for openssl-1_1","description":"This update for openssl-1_1 fixes the following issues:\n\nSecurity fixes:\n\n- CVE-2023-50782: Implicit rejection in PKCS#1 v1.5 (bsc#1220262)\n\nOther fixes:\n\n- FIPS: AES GCM external IV implementation (bsc#1228618)\n- FIPS: Mark PBKDF2 and HKDF HMAC input keys with size \u003e= 112 bits as approved in the SLI. (bsc#1228623)\n- FIPS: Enforce KDF in FIPS style (bsc#1224270)\n- FIPS: Mark HKDF and TLSv1.3 KDF as approved in the SLI (bsc#1228619)\n- FIPS: The X9.31 scheme is not approved for RSA signature operations in FIPS 186-5. (bsc#1224269)\n- FIPS: Differentiate the PSS length requirements (bsc#1224275)\n- FIPS: Mark sigGen and sigVer primitives as non-approved (bsc#1224272)\n- FIPS: Disable PKCSv1.5 and shake in FIPS mode (bsc#1224271)\n- FIPS: Mark SHA1 as non-approved in the SLI (bsc#1224266)\n- FIPS: DH FIPS selftest and safe prime group (bsc#1224264)\n- FIPS: Remove not needed FIPS DRBG files (bsc#1224268)\n- FIPS: Add Pair-wise Consistency Test when generating DH key (bsc#1224265)\n- FIPS: Disallow non-approved KDF types (bsc#1224267)\n- FIPS: Disallow RSA sigVer with 1024 and ECDSA sigVer/keyVer P-192 (bsc#1224273)\n- FIPS: DRBG component chaining (bsc#1224258)\n- FIPS: Align CRNGT_BUFSIZ with Jitter RNG output size (bsc#1224260)\n","status":"published","published":"2024-11-04T12:39:03Z","modified":"2026-02-04T03:23:38.667307Z","updated_at":"2026-11-02T15:53:55.639015Z"},{"id":"SUSE-SU-2024:3943-1","title":"Security update for openssl-3","description":"This update for openssl-3 fixes the following issues:\n\n- CVE-2023-50782: Implicit rejection in PKCS#1 v1.5 (bsc#1220262)\n","status":"published","published":"2024-11-07T10:12:01Z","modified":"2025-05-02T04:35:47.022409Z","updated_at":"2026-11-02T15:53:55.639015Z"},{"id":"SUSE-SU-2025:20081-1","title":"Security update for openssl-3","description":"This update for openssl-3 fixes the following issues:\n\n- CVE-2024-41996: Fixed a denial of service in the Diffie-Hellman Key Agreement Protocol (bsc#1230698).\n- CVE-2023-50782: Implicit rejection in PKCS#1 v1.5 (bsc#1220262)\n","status":"published","published":"2025-02-03T09:06:00Z","modified":"2026-03-23T04:50:03.417116Z","updated_at":"2026-11-02T15:53:59.381172Z"},{"id":"SUSE-SU-2025:20593-1","title":"Security update for openssl-3","description":"This update for openssl-3 fixes the following issues:\n\n- CVE-2023-50782: Implicit rejection in PKCS#1 v1.5 (bsc#1220262)\n","status":"published","published":"2025-08-14T10:09:46Z","modified":"2026-03-23T04:50:52.633649Z","updated_at":"2026-11-02T15:53:59.92114Z"},{"id":"USN-6673-1","title":"python-cryptography vulnerabilities","description":"Hubert Kario discovered that python-cryptography incorrectly handled \nerrors returned by the OpenSSL API when processing incorrect padding in \nRSA PKCS#1 v1.5. A remote attacker could possibly use this issue to expose \nconfidential or sensitive information. (CVE-2023-50782)\n\nIt was discovered that python-cryptography incorrectly handled memory \noperations when processing mismatched PKCS#12 keys. A remote attacker could \npossibly use this issue to cause python-cryptography to crash, leading to a\ndenial of service. This issue only affected Ubuntu 23.10. (CVE-2024-26130)\n","status":"published","published":"2024-03-04T14:23:13Z","modified":"2026-02-10T04:43:31Z","updated_at":"2026-11-02T16:58:17.914523Z"},{"id":"USN-6673-2","title":"python-cryptography vulnerability","description":"USN-6673-1 provided a security update for python-cryptography.\nThis update provides the corresponding update for Ubuntu 16.04 LTS.\n\nOriginal advisory details:\n\n Hubert Kario discovered that python-cryptography incorrectly handled \n errors returned by the OpenSSL API when processing incorrect padding in \n RSA PKCS#1 v1.5. A remote attacker could possibly use this issue to expose \n confidential or sensitive information. (CVE-2023-50782)\n","status":"published","published":"2024-03-14T08:59:53Z","modified":"2026-06-25T13:32:25.70413373Z","updated_at":"2026-11-02T16:58:17.914523Z"}]}}