CVE-2020-25657
Fixed in a distro release EPSS 2%
A flaw was found in all released versions of m2crypto, where they are vulnerable to Bleichenbacher timing attacks in the RSA decryption API via the timed processing of valid PKCS#1 v1.5 Ciphertext. The highest threat from this vulnerability is to confidentiality.
Products: m2crypto_project m2crypto, redhat virtualization, redhat enterprise_linux, fedoraproject fedora
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | m2crypto | 0.38.0-4 |
| Debian 13 | m2crypto | 0.38.0-4 |
| Red Hat rhev manager 4.4 el8 | ovirt-engine | 0:4.4.5.9-0.1.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-backend | 0:4.4.5.9-0.1.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-dbscripts | 0:4.4.5.9-0.1.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-health-check-bundler | 0:4.4.5.9-0.1.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-restapi | 0:4.4.5.9-0.1.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-setup | 0:4.4.5.9-0.1.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-setup-base | 0:4.4.5.9-0.1.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-setup-plugin-cinderlib | 0:4.4.5.9-0.1.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-setup-plugin-imageio | 0:4.4.5.9-0.1.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-setup-plugin-ovirt-engine | 0:4.4.5.9-0.1.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-setup-plugin-ovirt-engine-common | 0:4.4.5.9-0.1.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-setup-plugin-vmconsole-proxy-helper | 0:4.4.5.9-0.1.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-setup-plugin-websocket-proxy | 0:4.4.5.9-0.1.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-tools | 0:4.4.5.9-0.1.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-tools-backup | 0:4.4.5.9-0.1.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-vmconsole-proxy-helper | 0:4.4.5.9-0.1.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-webadmin-portal | 0:4.4.5.9-0.1.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-websocket-proxy | 0:4.4.5.9-0.1.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-web-ui | 0:1.6.7-1.el8ev |
| Red Hat rhev manager 4.4 el8 | python3-ovirt-engine-lib | 0:4.4.5.9-0.1.el8ev |
| Red Hat rhev manager 4.4 el8 | rhvm | 0:4.4.5.9-0.1.el8ev |
| SUSE Enterprise Storage 6 | python-M2Crypto | 0.35.2-150000.3.14.1 |
| SUSE Enterprise Storage 7 | python-M2Crypto | 0.35.2-150000.3.14.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS | python-M2Crypto | 0.35.2-150000.3.14.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS | python-M2Crypto | 0.35.2-150000.3.14.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS | python-M2Crypto | 0.35.2-150000.3.14.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS | python-M2Crypto | 0.35.2-150000.3.14.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | python-M2Crypto | 0.40.0-150400.3.9.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | python3-M2Crypto | 0.44.0-150400.13.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | python-M2Crypto | 0.40.0-150400.3.9.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | python3-M2Crypto | 0.44.0-150400.13.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | python3-M2Crypto | 0.44.0-150400.13.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | python3-M2Crypto | 0.44.0-150400.13.1 |
| SUSE Linux Enterprise High Performance Computing 15-ESPOS | python-M2Crypto | 0.35.2-150000.3.14.1 |
| SUSE Linux Enterprise High Performance Computing 15-LTSS | python-M2Crypto | 0.35.2-150000.3.14.1 |
| SUSE Linux Enterprise Micro 5.1 | python-M2Crypto | 0.35.2-150000.3.14.1 |
| SUSE Linux Enterprise Micro 5.2 | python-M2Crypto | 0.35.2-150000.3.14.1 |
| SUSE Linux Enterprise Micro 5.3 | python3-M2Crypto | 0.44.0-150400.13.1 |
| SUSE Linux Enterprise Micro 5.4 | python3-M2Crypto | 0.44.0-150400.13.1 |
| SUSE Linux Enterprise Micro 5.5 | python3-M2Crypto | 0.44.0-150400.13.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP3 | python-M2Crypto | 0.35.2-150000.3.14.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP4 | python-M2Crypto | 0.38.0-150400.3.6.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP4 | python-M2Crypto | 0.38.0-150400.3.3.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP6 | python3-M2Crypto | 0.44.0-150600.19.3.1 |
| SUSE Linux Enterprise Module for Public Cloud 12 | python-M2Crypto | 0.29.0-23.8.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 | python-M2Crypto | 0.35.2-150000.3.14.1 |
| SUSE Linux Enterprise Module for Python 2 15 SP3 | python-M2Crypto | 0.35.2-150000.3.14.1 |
| SUSE Linux Enterprise Module for Python 3 15 SP5 | python-M2Crypto | 0.40.0-150400.3.9.1 |
| SUSE Linux Enterprise Server 12 SP2-BCL | python-M2Crypto | 0.29.0-23.8.1 |
| SUSE Linux Enterprise Server 12 SP3-BCL | python-M2Crypto | 0.29.0-23.8.1 |
| SUSE Linux Enterprise Server 12 SP4-LTSS | python-M2Crypto | 0.29.0-23.8.1 |
| SUSE Linux Enterprise Server 12 SP5 | python-M2Crypto | 0.29.0-23.8.1 |
| SUSE Linux Enterprise Server 15 SP1-BCL | python-M2Crypto | 0.35.2-150000.3.14.1 |
| SUSE Linux Enterprise Server 15 SP1-LTSS | python-M2Crypto | 0.35.2-150000.3.14.1 |
| SUSE Linux Enterprise Server 15 SP2-BCL | python-M2Crypto | 0.35.2-150000.3.14.1 |
| SUSE Linux Enterprise Server 15 SP2-LTSS | python-M2Crypto | 0.35.2-150000.3.14.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | python-M2Crypto | 0.40.0-150400.3.9.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | python3-M2Crypto | 0.44.0-150400.13.1 |
| SUSE Linux Enterprise Server 15 SP5-LTSS | python3-M2Crypto | 0.44.0-150400.13.1 |
| SUSE Linux Enterprise Server 15-LTSS | python-M2Crypto | 0.35.2-150000.3.14.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP4 | python-M2Crypto | 0.29.0-23.8.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP5 | python-M2Crypto | 0.29.0-23.8.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 | python-M2Crypto | 0.35.2-150000.3.14.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP1 | python-M2Crypto | 0.35.2-150000.3.14.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP2 | python-M2Crypto | 0.35.2-150000.3.14.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | python-M2Crypto | 0.40.0-150400.3.9.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | python3-M2Crypto | 0.44.0-150400.13.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | python3-M2Crypto | 0.44.0-150400.13.1 |
| SUSE Manager Proxy 4.1 | python-M2Crypto | 0.35.2-150000.3.14.1 |
| SUSE Manager Proxy 4.3 | python3-M2Crypto | 0.44.0-150400.13.1 |
| SUSE Manager Retail Branch Server 4.1 | python-M2Crypto | 0.35.2-150000.3.14.1 |
| SUSE Manager Server 4.1 | python-M2Crypto | 0.35.2-150000.3.14.1 |
| SUSE Manager Server 4.3 | python3-M2Crypto | 0.44.0-150400.13.1 |
| SUSE OpenStack Cloud 9 | python-M2Crypto | 0.29.0-23.8.1 |
| SUSE OpenStack Cloud Crowbar 9 | python-M2Crypto | 0.29.0-23.8.1 |
| Ubuntu 14.04 LTS | m2crypto | no fix |
| Ubuntu 16.04 LTS | m2crypto | no fix |
| Ubuntu 18.04 LTS | m2crypto | no fix |
| Ubuntu 20.04 LTS | m2crypto | no fix |
| Ubuntu 22.04 LTS | m2crypto | no fix |
| Ubuntu 24.04 LTS | m2crypto | no fix |
| Ubuntu 25.10 | m2crypto | no fix |
| Ubuntu 26.04 LTS | m2crypto | no fix |
| openSUSE Leap 15.3 | python-M2Crypto | 0.35.2-150000.3.14.1 |
| openSUSE Leap 15.4 | python-M2Crypto | 0.38.0-150400.3.3.1 |
| openSUSE Leap 15.4 | python-M2Crypto | 0.38.0-150400.3.6.1 |
| openSUSE Leap 15.4 | python-M2Crypto | 0.35.2-150000.3.14.1 |
| openSUSE Leap 15.5 | python-M2Crypto | 0.40.0-150400.3.9.1 |
| openSUSE Leap 15.6 | python3-M2Crypto | 0.44.0-150600.19.3.1 |
| openSUSE Leap Micro 5.2 | python-M2Crypto | 0.35.2-150000.3.14.1 |