CVE catalog

CVE-2020-25657

m2crypto: CVE-2020-25657

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Published
Source
[NVD] · [CVE record]
EPSS
1.76% · Oct 27, 2026

A flaw was found in all released versions of m2crypto, where they are vulnerable to Bleichenbacher timing attacks in the RSA decryption API via the timed processing of valid PKCS#1 v1.5 Ciphertext. The highest threat from this vulnerability is to confidentiality.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianm2cryptotrixie0.42.0-3fixed
Debianm2cryptobookworm0.38.0-4fixed
Ubuntum2crypto14.040.21.1-3ubuntu3vulnerable
Ubuntum2crypto14.040.21.1-3ubuntu4vulnerable
Ubuntum2crypto14.040.21.1-3ubuntu5vulnerable
Ubuntum2crypto16.040.21.1-3ubuntu5vulnerable
Ubuntum2crypto16.040.22.6~rc4-1ubuntu1vulnerable
Ubuntum2crypto18.040.24.0-2vulnerable
Ubuntum2crypto18.040.27.0-2vulnerable
Ubuntum2crypto18.040.27.0-4vulnerable
Ubuntum2crypto18.040.27.0-4build1vulnerable
Ubuntum2crypto18.040.27.0-5vulnerable
Ubuntum2crypto20.040.31.0-6vulnerable
Ubuntum2crypto20.040.31.0-6build1vulnerable
Ubuntum2crypto20.040.31.0-7vulnerable
Ubuntum2crypto20.040.31.0-8vulnerable
Ubuntum2crypto20.040.31.0-9ubuntu1vulnerable
Ubuntum2crypto22.040.37.1-1ubuntu3vulnerable
Ubuntum2crypto22.040.37.1-1ubuntu4vulnerable
Ubuntum2crypto22.040.38.0-1ubuntu3vulnerable
Ubuntum2crypto22.040.38.0-1ubuntu5vulnerable
Ubuntum2crypto24.040.38.0-4build1vulnerable
Ubuntum2crypto24.040.38.0-4.1vulnerable
Ubuntum2crypto24.040.40.1-0ubuntu1vulnerable
Ubuntum2crypto24.040.40.1-1vulnerable
Ubuntum2crypto24.040.40.1-2build1vulnerable
Ubuntum2crypto24.040.40.1-2build2vulnerable
Ubuntum2crypto24.040.40.1-2ubuntu1vulnerable
Ubuntum2crypto25.100.42.0-2.1build1vulnerable
Ubuntum2crypto25.100.42.0-3vulnerable
Ubuntum2crypto26.040.42.0-3vulnerable
Ubuntum2crypto26.040.46.2-2vulnerable
Ubuntum2crypto26.040.46.2-3vulnerable
Ubuntum2crypto26.040.46.2-3build1vulnerable
Susepython-M2Cryptolinux enterprise module for python 3 15 sp50.40.0-150400.3.9.1fixed
Susepython-M2Cryptolinux enterprise high performance computing 15 sp4-espos0.40.0-150400.3.9.1fixed
Susepython-M2Cryptolinux enterprise high performance computing 15 sp4-ltss0.40.0-150400.3.9.1fixed
Susepython-M2Cryptolinux enterprise server 15 sp4-ltss0.40.0-150400.3.9.1fixed
Susepython-M2Cryptolinux enterprise server for sap applications 15 sp40.40.0-150400.3.9.1fixed
Opensusepython-M2Cryptoleap 15.50.40.0-150400.3.9.1fixed
Susepython3-M2Cryptolinux enterprise micro 5.30.44.0-150400.13.1fixed
Susepython3-M2Cryptolinux enterprise micro 5.40.44.0-150400.13.1fixed
Susepython3-M2Cryptolinux enterprise micro 5.50.44.0-150400.13.1fixed
Susepython3-M2Cryptolinux enterprise high performance computing 15 sp4-espos0.44.0-150400.13.1fixed
Susepython3-M2Cryptolinux enterprise high performance computing 15 sp4-ltss0.44.0-150400.13.1fixed
Susepython3-M2Cryptolinux enterprise high performance computing 15 sp5-espos0.44.0-150400.13.1fixed
Susepython3-M2Cryptolinux enterprise high performance computing 15 sp5-ltss0.44.0-150400.13.1fixed
Susepython3-M2Cryptolinux enterprise server 15 sp4-ltss0.44.0-150400.13.1fixed
Susepython3-M2Cryptolinux enterprise server 15 sp5-ltss0.44.0-150400.13.1fixed
Susepython3-M2Cryptolinux enterprise server for sap applications 15 sp40.44.0-150400.13.1fixed
Susepython3-M2Cryptolinux enterprise server for sap applications 15 sp50.44.0-150400.13.1fixed
Susepython3-M2Cryptomanager proxy 4.30.44.0-150400.13.1fixed
Susepython3-M2Cryptomanager server 4.30.44.0-150400.13.1fixed
Susepython-M2Cryptolinux enterprise module for basesystem 15 sp40.38.0-150400.3.6.1fixed
Opensusepython-M2Cryptoleap 15.40.38.0-150400.3.6.1fixed
Susepython3-M2Cryptolinux enterprise module for basesystem 15 sp60.44.0-150600.19.3.1fixed
Opensusepython3-M2Cryptoleap 15.60.44.0-150600.19.3.1fixed
Susepython-M2Cryptolinux enterprise module for basesystem 15 sp30.35.2-150000.3.14.1fixed
Susepython-M2Cryptolinux enterprise module for public cloud 150.35.2-150000.3.14.1fixed
Susepython-M2Cryptolinux enterprise module for python 2 15 sp30.35.2-150000.3.14.1fixed
Susepython-M2Cryptolinux enterprise high performance computing 15-espos0.35.2-150000.3.14.1fixed
Susepython-M2Cryptolinux enterprise high performance computing 15-ltss0.35.2-150000.3.14.1fixed
Susepython-M2Cryptolinux enterprise high performance computing 15 sp1-espos0.35.2-150000.3.14.1fixed
Susepython-M2Cryptolinux enterprise high performance computing 15 sp1-ltss0.35.2-150000.3.14.1fixed
Susepython-M2Cryptolinux enterprise high performance computing 15 sp2-espos0.35.2-150000.3.14.1fixed
Susepython-M2Cryptolinux enterprise high performance computing 15 sp2-ltss0.35.2-150000.3.14.1fixed
Susepython-M2Cryptolinux enterprise server 15-ltss0.35.2-150000.3.14.1fixed
Susepython-M2Cryptolinux enterprise server 15 sp1-bcl0.35.2-150000.3.14.1fixed
Susepython-M2Cryptolinux enterprise server 15 sp1-ltss0.35.2-150000.3.14.1fixed
Susepython-M2Cryptolinux enterprise server 15 sp2-bcl0.35.2-150000.3.14.1fixed
Susepython-M2Cryptolinux enterprise server 15 sp2-ltss0.35.2-150000.3.14.1fixed
Susepython-M2Cryptolinux enterprise server for sap applications 150.35.2-150000.3.14.1fixed
Susepython-M2Cryptolinux enterprise server for sap applications 15 sp10.35.2-150000.3.14.1fixed
Susepython-M2Cryptolinux enterprise server for sap applications 15 sp20.35.2-150000.3.14.1fixed
Susepython-M2Cryptomanager proxy 4.10.35.2-150000.3.14.1fixed
Susepython-M2Cryptomanager retail branch server 4.10.35.2-150000.3.14.1fixed
Susepython-M2Cryptomanager server 4.10.35.2-150000.3.14.1fixed
Susepython-M2Cryptolinux enterprise micro 5.10.35.2-150000.3.14.1fixed
Susepython-M2Cryptolinux enterprise micro 5.20.35.2-150000.3.14.1fixed
Susepython-M2Cryptoenterprise storage 60.35.2-150000.3.14.1fixed
Susepython-M2Cryptoenterprise storage 70.35.2-150000.3.14.1fixed
Opensusepython-M2Cryptoleap 15.30.35.2-150000.3.14.1fixed
Opensusepython-M2Cryptoleap 15.40.35.2-150000.3.14.1fixed
Susepython-M2Cryptoopenstack cloud 90.29.0-23.8.1fixed
Susepython-M2Cryptoopenstack cloud crowbar 90.29.0-23.8.1fixed
Susepython-M2Cryptolinux enterprise module for public cloud 120.29.0-23.8.1fixed
Susepython-M2Cryptolinux enterprise server for sap applications 12 sp40.29.0-23.8.1fixed
Susepython-M2Cryptolinux enterprise server 12 sp2-bcl0.29.0-23.8.1fixed
Susepython-M2Cryptolinux enterprise server 12 sp3-bcl0.29.0-23.8.1fixed
Susepython-M2Cryptolinux enterprise server 12 sp4-ltss0.29.0-23.8.1fixed
Susepython-M2Cryptolinux enterprise server 12 sp50.29.0-23.8.1fixed
Susepython-M2Cryptolinux enterprise server for sap applications 12 sp50.29.0-23.8.1fixed
Opensusepython-M2Cryptoleap micro 5.20.35.2-150000.3.14.1fixed
Susepython-M2Cryptolinux enterprise module for basesystem 15 sp40.38.0-150400.3.3.1fixed
Opensusepython-M2Cryptoleap 15.40.38.0-150400.3.3.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianm2cryptosourcetrixie0.38.0-4not yet assignedNot reported[975002]
Debianm2cryptosourcebookworm0.38.0-4not yet assignedNot reported[975002]
Susepython-M2Cryptorpmlinux enterprise module for python 3 15 sp50.40.0-150400.3.9.1Not reportedSUSE-FU-2024:1448-1Not reported
Susepython-M2Cryptorpmlinux enterprise high performance computing 15 sp4-espos0.40.0-150400.3.9.1Not reportedSUSE-FU-2024:1448-1Not reported
Susepython-M2Cryptorpmlinux enterprise high performance computing 15 sp4-ltss0.40.0-150400.3.9.1Not reportedSUSE-FU-2024:1448-1Not reported
Susepython-M2Cryptorpmlinux enterprise server 15 sp4-ltss0.40.0-150400.3.9.1Not reportedSUSE-FU-2024:1448-1Not reported
Susepython-M2Cryptorpmlinux enterprise server for sap applications 15 sp40.40.0-150400.3.9.1Not reportedSUSE-FU-2024:1448-1Not reported
Opensusepython-M2Cryptorpmleap 15.50.40.0-150400.3.9.1Not reportedSUSE-FU-2024:1448-1Not reported
Susepython3-M2Cryptorpmlinux enterprise micro 5.30.44.0-150400.13.1Not reportedSUSE-RU-2025:0800-1Not reported
Susepython3-M2Cryptorpmlinux enterprise micro 5.40.44.0-150400.13.1Not reportedSUSE-RU-2025:0800-1Not reported
Susepython3-M2Cryptorpmlinux enterprise micro 5.50.44.0-150400.13.1Not reportedSUSE-RU-2025:0800-1Not reported
Susepython3-M2Cryptorpmlinux enterprise high performance computing 15 sp4-espos0.44.0-150400.13.1Not reportedSUSE-RU-2025:0800-1Not reported
Susepython3-M2Cryptorpmlinux enterprise high performance computing 15 sp4-ltss0.44.0-150400.13.1Not reportedSUSE-RU-2025:0800-1Not reported
Susepython3-M2Cryptorpmlinux enterprise high performance computing 15 sp5-espos0.44.0-150400.13.1Not reportedSUSE-RU-2025:0800-1Not reported
Susepython3-M2Cryptorpmlinux enterprise high performance computing 15 sp5-ltss0.44.0-150400.13.1Not reportedSUSE-RU-2025:0800-1Not reported
Susepython3-M2Cryptorpmlinux enterprise server 15 sp4-ltss0.44.0-150400.13.1Not reportedSUSE-RU-2025:0800-1Not reported
Susepython3-M2Cryptorpmlinux enterprise server 15 sp5-ltss0.44.0-150400.13.1Not reportedSUSE-RU-2025:0800-1Not reported
Susepython3-M2Cryptorpmlinux enterprise server for sap applications 15 sp40.44.0-150400.13.1Not reportedSUSE-RU-2025:0800-1Not reported
Susepython3-M2Cryptorpmlinux enterprise server for sap applications 15 sp50.44.0-150400.13.1Not reportedSUSE-RU-2025:0800-1Not reported
Susepython3-M2Cryptorpmmanager proxy 4.30.44.0-150400.13.1Not reportedSUSE-RU-2025:0800-1Not reported
Susepython3-M2Cryptorpmmanager server 4.30.44.0-150400.13.1Not reportedSUSE-RU-2025:0800-1Not reported
Susepython-M2Cryptorpmlinux enterprise module for basesystem 15 sp40.38.0-150400.3.6.1Not reportedSUSE-SU-2022:2691-1Not reported
Opensusepython-M2Cryptorpmleap 15.40.38.0-150400.3.6.1Not reportedSUSE-SU-2022:2691-1Not reported
Susepython3-M2Cryptorpmlinux enterprise module for basesystem 15 sp60.44.0-150600.19.3.1Not reportedSUSE-RU-2025:0796-1Not reported
Opensusepython3-M2Cryptorpmleap 15.60.44.0-150600.19.3.1Not reportedSUSE-RU-2025:0796-1Not reported
Susepython-M2Cryptorpmlinux enterprise module for basesystem 15 sp30.35.2-150000.3.14.1Not reportedSUSE-SU-2022:2562-1Not reported
Susepython-M2Cryptorpmlinux enterprise module for public cloud 150.35.2-150000.3.14.1Not reportedSUSE-SU-2022:2562-1Not reported
Susepython-M2Cryptorpmlinux enterprise module for python 2 15 sp30.35.2-150000.3.14.1Not reportedSUSE-SU-2022:2562-1Not reported
Susepython-M2Cryptorpmlinux enterprise high performance computing 15-espos0.35.2-150000.3.14.1Not reportedSUSE-SU-2022:2562-1Not reported
Susepython-M2Cryptorpmlinux enterprise high performance computing 15-ltss0.35.2-150000.3.14.1Not reportedSUSE-SU-2022:2562-1Not reported
Susepython-M2Cryptorpmlinux enterprise high performance computing 15 sp1-espos0.35.2-150000.3.14.1Not reportedSUSE-SU-2022:2562-1Not reported
Susepython-M2Cryptorpmlinux enterprise high performance computing 15 sp1-ltss0.35.2-150000.3.14.1Not reportedSUSE-SU-2022:2562-1Not reported
Susepython-M2Cryptorpmlinux enterprise high performance computing 15 sp2-espos0.35.2-150000.3.14.1Not reportedSUSE-SU-2022:2562-1Not reported
Susepython-M2Cryptorpmlinux enterprise high performance computing 15 sp2-ltss0.35.2-150000.3.14.1Not reportedSUSE-SU-2022:2562-1Not reported
Susepython-M2Cryptorpmlinux enterprise server 15-ltss0.35.2-150000.3.14.1Not reportedSUSE-SU-2022:2562-1Not reported
Susepython-M2Cryptorpmlinux enterprise server 15 sp1-bcl0.35.2-150000.3.14.1Not reportedSUSE-SU-2022:2562-1Not reported
Susepython-M2Cryptorpmlinux enterprise server 15 sp1-ltss0.35.2-150000.3.14.1Not reportedSUSE-SU-2022:2562-1Not reported
Susepython-M2Cryptorpmlinux enterprise server 15 sp2-bcl0.35.2-150000.3.14.1Not reportedSUSE-SU-2022:2562-1Not reported
Susepython-M2Cryptorpmlinux enterprise server 15 sp2-ltss0.35.2-150000.3.14.1Not reportedSUSE-SU-2022:2562-1Not reported
Susepython-M2Cryptorpmlinux enterprise server for sap applications 150.35.2-150000.3.14.1Not reportedSUSE-SU-2022:2562-1Not reported
Susepython-M2Cryptorpmlinux enterprise server for sap applications 15 sp10.35.2-150000.3.14.1Not reportedSUSE-SU-2022:2562-1Not reported
Susepython-M2Cryptorpmlinux enterprise server for sap applications 15 sp20.35.2-150000.3.14.1Not reportedSUSE-SU-2022:2562-1Not reported
Susepython-M2Cryptorpmmanager proxy 4.10.35.2-150000.3.14.1Not reportedSUSE-SU-2022:2562-1Not reported
Susepython-M2Cryptorpmmanager retail branch server 4.10.35.2-150000.3.14.1Not reportedSUSE-SU-2022:2562-1Not reported
Susepython-M2Cryptorpmmanager server 4.10.35.2-150000.3.14.1Not reportedSUSE-SU-2022:2562-1Not reported
Susepython-M2Cryptorpmlinux enterprise micro 5.10.35.2-150000.3.14.1Not reportedSUSE-SU-2022:2562-1Not reported
Susepython-M2Cryptorpmlinux enterprise micro 5.20.35.2-150000.3.14.1Not reportedSUSE-SU-2022:2562-1Not reported
Susepython-M2Cryptorpmenterprise storage 60.35.2-150000.3.14.1Not reportedSUSE-SU-2022:2562-1Not reported
Susepython-M2Cryptorpmenterprise storage 70.35.2-150000.3.14.1Not reportedSUSE-SU-2022:2562-1Not reported
Opensusepython-M2Cryptorpmleap 15.30.35.2-150000.3.14.1Not reportedSUSE-SU-2022:2562-1Not reported
Opensusepython-M2Cryptorpmleap 15.40.35.2-150000.3.14.1Not reportedSUSE-SU-2022:2562-1Not reported
Susepython-M2Cryptorpmopenstack cloud 90.29.0-23.8.1Not reportedSUSE-SU-2022:2527-1Not reported
Susepython-M2Cryptorpmopenstack cloud crowbar 90.29.0-23.8.1Not reportedSUSE-SU-2022:2527-1Not reported
Susepython-M2Cryptorpmlinux enterprise module for public cloud 120.29.0-23.8.1Not reportedSUSE-SU-2022:2527-1Not reported
Susepython-M2Cryptorpmlinux enterprise server for sap applications 12 sp40.29.0-23.8.1Not reportedSUSE-SU-2022:2527-1Not reported
Susepython-M2Cryptorpmlinux enterprise server 12 sp2-bcl0.29.0-23.8.1Not reportedSUSE-SU-2022:2527-1Not reported
Susepython-M2Cryptorpmlinux enterprise server 12 sp3-bcl0.29.0-23.8.1Not reportedSUSE-SU-2022:2527-1Not reported
Susepython-M2Cryptorpmlinux enterprise server 12 sp4-ltss0.29.0-23.8.1Not reportedSUSE-SU-2022:2527-1Not reported
Susepython-M2Cryptorpmlinux enterprise server 12 sp50.29.0-23.8.1Not reportedSUSE-SU-2022:2527-1Not reported
Susepython-M2Cryptorpmlinux enterprise server for sap applications 12 sp50.29.0-23.8.1Not reportedSUSE-SU-2022:2527-1Not reported
Opensusepython-M2Cryptorpmleap micro 5.20.35.2-150000.3.14.1Not reportedOPENSUSE-SU-2022:2562-1Not reported
Susepython-M2Cryptorpmlinux enterprise module for basesystem 15 sp40.38.0-150400.3.3.1Not reportedSUSE-SU-2022:2532-1Not reported
Opensusepython-M2Cryptorpmleap 15.40.38.0-150400.3.3.1Not reportedSUSE-SU-2022:2532-1Not reported

[Debian bug #975002]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • Source package: [m2crypto]

    Details (2)
    • 0.38.0-4+b1 · amd64 · bookworm

      Fixed · Fixed: 0.38.0-4

      dsa · m2crypto · debian · bookworm; dsa · m2crypto · debian · 12

    • 0.38.0-4+b1 · arm64 · bookworm

      Fixed · Fixed: 0.38.0-4

      dsa · m2crypto · debian · bookworm; dsa · m2crypto · debian · 12

  • Source package: [m2crypto]

    Details (2)
    • 0.38.0-4 · all · bookworm

      Fixed · Fixed: 0.38.0-4

      dsa · m2crypto · debian · bookworm; dsa · m2crypto · debian · 12

    • 0.38.0-4 · all · bookworm

      Fixed · Fixed: 0.38.0-4

      dsa · m2crypto · debian · bookworm; dsa · m2crypto · debian · 12

[Debian 13 (Trixie)]

  • Source package: [m2crypto]

    Details (2)
    • 0.42.0-3 · amd64 · trixie

      Fixed · Fixed: 0.38.0-4

      dsa · m2crypto · debian · 13

    • 0.42.0-3 · arm64 · trixie

      Fixed · Fixed: 0.38.0-4

      dsa · m2crypto · debian · 13

  • Source package: [m2crypto]

    Details (2)
    • 0.42.0-3 · all · trixie

      Fixed · Fixed: 0.38.0-4

      dsa · m2crypto · debian · 13

    • 0.42.0-3 · all · trixie

      Fixed · Fixed: 0.38.0-4

      dsa · m2crypto · debian · 13

Observed:

References