CVE catalog

CVE-2020-25659

python-cryptography: CVE-2020-25659

[CVE catalog]

Severity
Medium · CVSS 5.9CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Published
Source
[NVD] · [CVE record]
EPSS
2.46% · Oct 25, 2026

python-cryptography 3.2 is vulnerable to Bleichenbacher timing attacks in the RSA decryption API, via timed processing of valid PKCS#1 v1.5 ciphertext.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianpython-cryptographysid49.0.0-2fixed
Debianpython-cryptographyforky49.0.0-2fixed
Debianpython-cryptographytrixie43.0.0-3+deb13u1fixed
Debianpython-cryptographybookworm38.0.4-3+deb12u1fixed
Debianpython-cryptographybookworm-security38.0.4-3~deb12u1fixed
Alpinepy3-cryptography3.133.2.1-r0fixed
Alpinepy3-cryptography3.143.2.1-r0fixed
Alpinepy3-cryptography3.233.2.1-r0fixed
Alpinepy3-cryptography3.243.2.1-r0fixed
Opensusepython-cryptographytumbleweed50.0.0-1.1fixed
Ubuntupython-cryptography16.041.0.1-1ubuntu1vulnerable
Ubuntupython-cryptography16.041.0.2-1vulnerable
Ubuntupython-cryptography16.041.1-1vulnerable
Ubuntupython-cryptography16.041.1.1-1vulnerable
Ubuntupython-cryptography16.041.1.1-1ubuntu1vulnerable
Ubuntupython-cryptography16.041.1.1-1ubuntu2vulnerable
Ubuntupython-cryptography16.041.1.1-1ubuntu3vulnerable
Ubuntupython-cryptography16.041.2.2-2vulnerable
Ubuntupython-cryptography16.041.2.3-1vulnerable
Ubuntupython-cryptography16.041.2.3-1ubuntu0.1vulnerable
Ubuntupython-cryptography16.041.2.3-1ubuntu0.2vulnerable
Ubuntupython-cryptography16.041.2.3-1ubuntu0.3fixed
Ubuntupython-cryptography18.041.9-1vulnerable
Ubuntupython-cryptography18.042.1.3-3vulnerable
Ubuntupython-cryptography18.042.1.4-1vulnerable
Ubuntupython-cryptography18.042.1.4-1build1vulnerable
Ubuntupython-cryptography18.042.1.4-1build2vulnerable
Ubuntupython-cryptography18.042.1.4-1ubuntu1vulnerable
Ubuntupython-cryptography18.042.1.4-1ubuntu1.1vulnerable
Ubuntupython-cryptography18.042.1.4-1ubuntu1.2vulnerable
Ubuntupython-cryptography18.042.1.4-1ubuntu1.3vulnerable
Ubuntupython-cryptography18.042.1.4-1ubuntu1.4fixed
Ubuntupython-cryptography20.042.6.1-3.1vulnerable
Ubuntupython-cryptography20.042.6.1-4vulnerable
Ubuntupython-cryptography20.042.6.1-4ubuntu1vulnerable
Ubuntupython-cryptography20.042.8-1ubuntu2vulnerable
Ubuntupython-cryptography20.042.8-2vulnerable
Ubuntupython-cryptography20.042.8-3vulnerable
Ubuntupython-cryptography20.042.8-3ubuntu0.1fixed
Susepython-cryptographylinux enterprise high performance computing 15 sp2-ltss3.3.2-150200.16.1fixed
Susepython-cryptographylinux enterprise high performance computing 15 sp3-espos3.3.2-150200.16.1fixed
Susepython-cryptographylinux enterprise high performance computing 15 sp3-ltss3.3.2-150200.16.1fixed
Susepython-cryptographylinux enterprise real time 15 sp33.3.2-150200.16.1fixed
Susepython-cryptographylinux enterprise server 15 sp2-ltss3.3.2-150200.16.1fixed
Susepython-cryptographylinux enterprise server 15 sp3-ltss3.3.2-150200.16.1fixed
Susepython-cryptographylinux enterprise server for sap applications 15 sp23.3.2-150200.16.1fixed
Susepython-cryptographylinux enterprise server for sap applications 15 sp33.3.2-150200.16.1fixed
Susepython-cryptographymanager proxy 4.23.3.2-150200.16.1fixed
Susepython-cryptographymanager server 4.23.3.2-150200.16.1fixed
Susepython-cryptographylinux enterprise micro 5.13.3.2-150200.16.1fixed
Susepython-cryptographylinux enterprise micro 5.23.3.2-150200.16.1fixed
Susepython-cryptographyenterprise storage 73.3.2-150200.16.1fixed
Susepython-cryptographyenterprise storage 7.13.3.2-150200.16.1fixed
Susepython-cryptographylinux enterprise module for basesystem 15 sp22.8-3.3.1fixed
Susepython-cryptographylinux enterprise module for python 2 15 sp22.8-3.3.1fixed
Opensusepython-cryptographytumbleweed3.3.2-2.4fixed
Opensusepython-cryptographyleap 15.22.8-lp152.2.3.1fixed
Susepython-cryptographyhpe helion openstack 82.1.4-7.31.1fixed
Susepython-cryptographyopenstack cloud 72.1.4-7.31.1fixed
Susepython-cryptographyopenstack cloud 82.1.4-7.31.1fixed
Susepython-cryptographyopenstack cloud 92.1.4-7.31.1fixed
Susepython-cryptographyopenstack cloud crowbar 82.1.4-7.31.1fixed
Susepython-cryptographyopenstack cloud crowbar 92.1.4-7.31.1fixed
Susepython-cryptographylinux enterprise server for sap applications 12 sp22.1.4-7.31.1fixed
Susepython-cryptographylinux enterprise server for sap applications 12 sp32.1.4-7.31.1fixed
Susepython-cryptographylinux enterprise server for sap applications 12 sp42.1.4-7.31.1fixed
Susepython-cryptographylinux enterprise server 12 sp2-ltss2.1.4-7.31.1fixed
Susepython-cryptographylinux enterprise server 12 sp2-bcl2.1.4-7.31.1fixed
Susepython-cryptographylinux enterprise server 12 sp3-ltss2.1.4-7.31.1fixed
Susepython-cryptographylinux enterprise server 12 sp3-bcl2.1.4-7.31.1fixed
Susepython-cryptographylinux enterprise server 12 sp4-ltss2.1.4-7.31.1fixed
Susepython-cryptographylinux enterprise server 12 sp52.1.4-7.31.1fixed
Susepython-cryptographylinux enterprise server for sap applications 12 sp52.1.4-7.31.1fixed
Susepython-cryptographyenterprise storage 52.1.4-7.31.1fixed
Susepython-cryptographylinux enterprise module for basesystem 15 sp43.3.2-150400.16.3.1fixed
Opensusepython-cryptographyleap 15.43.3.2-150400.16.3.1fixed
Opensusepython-cryptography-vectorsleap 15.43.3.2-150400.7.3.1fixed
Opensusepython-cryptographytumbleweed42.0.5-1.1fixed
Ubuntupython-cryptography16.041.0.1-1ubuntu1vulnerable
Ubuntupython-cryptography16.041.0.2-1vulnerable
Ubuntupython-cryptography16.041.1-1vulnerable
Ubuntupython-cryptography16.041.1.1-1vulnerable
Ubuntupython-cryptography16.041.1.1-1ubuntu1vulnerable
Ubuntupython-cryptography16.041.1.1-1ubuntu2vulnerable
Ubuntupython-cryptography16.041.1.1-1ubuntu3vulnerable
Ubuntupython-cryptography16.041.2.2-2vulnerable
Ubuntupython-cryptography16.041.2.3-1vulnerable
Ubuntupython-cryptography16.041.2.3-1ubuntu0.1vulnerable
Ubuntupython-cryptography16.041.2.3-1ubuntu0.2vulnerable
Ubuntupython-cryptography16.041.2.3-1ubuntu0.3fixed
Ubuntupython-cryptography18.041.9-1vulnerable
Ubuntupython-cryptography18.042.1.3-3vulnerable
Ubuntupython-cryptography18.042.1.4-1vulnerable
Ubuntupython-cryptography18.042.1.4-1build1vulnerable
Ubuntupython-cryptography18.042.1.4-1build2vulnerable
Ubuntupython-cryptography18.042.1.4-1ubuntu1vulnerable
Ubuntupython-cryptography18.042.1.4-1ubuntu1.1vulnerable
Ubuntupython-cryptography18.042.1.4-1ubuntu1.2vulnerable
Ubuntupython-cryptography18.042.1.4-1ubuntu1.3vulnerable
Ubuntupython-cryptography18.042.1.4-1ubuntu1.4fixed
Ubuntupython-cryptography20.042.6.1-3.1vulnerable
Ubuntupython-cryptography20.042.6.1-4vulnerable
Ubuntupython-cryptography20.042.6.1-4ubuntu1vulnerable
Ubuntupython-cryptography20.042.8-1ubuntu2vulnerable
Ubuntupython-cryptography20.042.8-2vulnerable
Ubuntupython-cryptography20.042.8-3vulnerable
Ubuntupython-cryptography20.042.8-3ubuntu0.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianpython-cryptographysourcesid3.2.1-1not yet assignedNot reported[973247]
Debianpython-cryptographysourceforky3.2.1-1not yet assignedNot reported[973247]
Debianpython-cryptographysourcetrixie3.2.1-1not yet assignedNot reported[973247]
Debianpython-cryptographysourcebookworm3.2.1-1not yet assignedNot reported[973247]
Alpinepy3-cryptographyapk3.133.2.1-r0Not reportedALPINE-CVE-2020-25659Not reported
Alpinepy3-cryptographyapk3.143.2.1-r0Not reportedALPINE-CVE-2020-25659Not reported
Alpinepy3-cryptographyapk3.233.2.1-r0Not reportedALPINE-CVE-2020-25659Not reported
Alpinepy3-cryptographyapk3.243.2.1-r0Not reportedALPINE-CVE-2020-25659Not reported
Opensusepython-cryptographyrpmtumbleweed50.0.0-1.1Not reportedOPENSUSE-SU-2026:11468-1Not reported
Ubuntupython-cryptographydeb16.041.2.3-1ubuntu0.3Not reportedUSN-4613-1Not reported
Ubuntupython-cryptographydeb18.042.1.4-1ubuntu1.4Not reportedUSN-4613-1Not reported
Ubuntupython-cryptographydeb20.042.8-3ubuntu0.1Not reportedUSN-4613-1Not reported
Susepython-cryptographyrpmlinux enterprise high performance computing 15 sp2-ltss3.3.2-150200.16.1Not reportedSUSE-SU-2023:0604-1Not reported
Susepython-cryptographyrpmlinux enterprise high performance computing 15 sp3-espos3.3.2-150200.16.1Not reportedSUSE-SU-2023:0604-1Not reported
Susepython-cryptographyrpmlinux enterprise high performance computing 15 sp3-ltss3.3.2-150200.16.1Not reportedSUSE-SU-2023:0604-1Not reported
Susepython-cryptographyrpmlinux enterprise real time 15 sp33.3.2-150200.16.1Not reportedSUSE-SU-2023:0604-1Not reported
Susepython-cryptographyrpmlinux enterprise server 15 sp2-ltss3.3.2-150200.16.1Not reportedSUSE-SU-2023:0604-1Not reported
Susepython-cryptographyrpmlinux enterprise server 15 sp3-ltss3.3.2-150200.16.1Not reportedSUSE-SU-2023:0604-1Not reported
Susepython-cryptographyrpmlinux enterprise server for sap applications 15 sp23.3.2-150200.16.1Not reportedSUSE-SU-2023:0604-1Not reported
Susepython-cryptographyrpmlinux enterprise server for sap applications 15 sp33.3.2-150200.16.1Not reportedSUSE-SU-2023:0604-1Not reported
Susepython-cryptographyrpmmanager proxy 4.23.3.2-150200.16.1Not reportedSUSE-SU-2023:0604-1Not reported
Susepython-cryptographyrpmmanager server 4.23.3.2-150200.16.1Not reportedSUSE-SU-2023:0604-1Not reported
Susepython-cryptographyrpmlinux enterprise micro 5.13.3.2-150200.16.1Not reportedSUSE-SU-2023:0604-1Not reported
Susepython-cryptographyrpmlinux enterprise micro 5.23.3.2-150200.16.1Not reportedSUSE-SU-2023:0604-1Not reported
Susepython-cryptographyrpmenterprise storage 73.3.2-150200.16.1Not reportedSUSE-SU-2023:0604-1Not reported
Susepython-cryptographyrpmenterprise storage 7.13.3.2-150200.16.1Not reportedSUSE-SU-2023:0604-1Not reported
Susepython-cryptographyrpmlinux enterprise module for basesystem 15 sp22.8-3.3.1Not reportedSUSE-SU-2020:3592-1Not reported
Susepython-cryptographyrpmlinux enterprise module for python 2 15 sp22.8-3.3.1Not reportedSUSE-SU-2020:3592-1Not reported
Opensusepython-cryptographyrpmtumbleweed3.3.2-2.4Not reportedOPENSUSE-SU-2024:11223-1Not reported
Opensusepython-cryptographyrpmleap 15.22.8-lp152.2.3.1Not reportedOPENSUSE-SU-2020:2173-1Not reported
Susepython-cryptographyrpmhpe helion openstack 82.1.4-7.31.1Not reportedSUSE-SU-2020:3629-1Not reported
Susepython-cryptographyrpmopenstack cloud 72.1.4-7.31.1Not reportedSUSE-SU-2020:3629-1Not reported
Susepython-cryptographyrpmopenstack cloud 82.1.4-7.31.1Not reportedSUSE-SU-2020:3629-1Not reported
Susepython-cryptographyrpmopenstack cloud 92.1.4-7.31.1Not reportedSUSE-SU-2020:3629-1Not reported
Susepython-cryptographyrpmopenstack cloud crowbar 82.1.4-7.31.1Not reportedSUSE-SU-2020:3629-1Not reported
Susepython-cryptographyrpmopenstack cloud crowbar 92.1.4-7.31.1Not reportedSUSE-SU-2020:3629-1Not reported
Susepython-cryptographyrpmlinux enterprise server for sap applications 12 sp22.1.4-7.31.1Not reportedSUSE-SU-2020:3629-1Not reported
Susepython-cryptographyrpmlinux enterprise server for sap applications 12 sp32.1.4-7.31.1Not reportedSUSE-SU-2020:3629-1Not reported
Susepython-cryptographyrpmlinux enterprise server for sap applications 12 sp42.1.4-7.31.1Not reportedSUSE-SU-2020:3629-1Not reported
Susepython-cryptographyrpmlinux enterprise server 12 sp2-ltss2.1.4-7.31.1Not reportedSUSE-SU-2020:3629-1Not reported
Susepython-cryptographyrpmlinux enterprise server 12 sp2-bcl2.1.4-7.31.1Not reportedSUSE-SU-2020:3629-1Not reported
Susepython-cryptographyrpmlinux enterprise server 12 sp3-ltss2.1.4-7.31.1Not reportedSUSE-SU-2020:3629-1Not reported
Susepython-cryptographyrpmlinux enterprise server 12 sp3-bcl2.1.4-7.31.1Not reportedSUSE-SU-2020:3629-1Not reported
Susepython-cryptographyrpmlinux enterprise server 12 sp4-ltss2.1.4-7.31.1Not reportedSUSE-SU-2020:3629-1Not reported
Susepython-cryptographyrpmlinux enterprise server 12 sp52.1.4-7.31.1Not reportedSUSE-SU-2020:3629-1Not reported
Susepython-cryptographyrpmlinux enterprise server for sap applications 12 sp52.1.4-7.31.1Not reportedSUSE-SU-2020:3629-1Not reported
Susepython-cryptographyrpmenterprise storage 52.1.4-7.31.1Not reportedSUSE-SU-2020:3629-1Not reported
Susepython-cryptographyrpmlinux enterprise module for basesystem 15 sp43.3.2-150400.16.3.1Not reportedSUSE-RU-2022:2355-1Not reported
Opensusepython-cryptographyrpmleap 15.43.3.2-150400.16.3.1Not reportedSUSE-RU-2022:2355-1Not reported
Opensusepython-cryptography-vectorsrpmleap 15.43.3.2-150400.7.3.1Not reportedSUSE-RU-2022:2355-1Not reported
Opensusepython-cryptographyrpmtumbleweed42.0.5-1.1Not reportedOPENSUSE-SU-2024:13819-1Not reported
Ubuntupython-cryptographydeb16.041.2.3-1ubuntu0.3Not reportedUBUNTU-CVE-2020-25659Not reported
Ubuntupython-cryptographydeb18.042.1.4-1ubuntu1.4Not reportedUBUNTU-CVE-2020-25659Not reported
Ubuntupython-cryptographydeb20.042.8-3ubuntu0.1Not reportedUBUNTU-CVE-2020-25659Not reported

[Debian bug #973247]

OpenFactory catalog packages

[openSUSE Tumbleweed]

  • Source package: [python-cryptography]

    Details (1)
    • 50.0.0-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 3.3.2-2.4, 42.0.5-1.1, 50.0.0-1.1

      Version impact unknown

      dsa · python-cryptography · opensuse · tumbleweed

  • Source package: [python-cryptography]

    Details (1)
    • 50.0.0-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 3.3.2-2.4, 42.0.5-1.1, 50.0.0-1.1

      Version impact unknown

      dsa · python-cryptography · opensuse · tumbleweed

[Debian 12 (Bookworm)]

  • Source package: [python-cryptography]

    Details (4)
    • 38.0.4-3+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 3.2.1-1

      dsa · python-cryptography · debian · bookworm; dsa · python-cryptography · debian · 12

    • 38.0.4-3+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 3.2.1-1

      dsa · python-cryptography · debian · bookworm; dsa · python-cryptography · debian · 12

    • 38.0.4-3~deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 3.2.1-1

      dsa · python-cryptography · debian · bookworm; dsa · python-cryptography · debian · 12

    • 38.0.4-3~deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 3.2.1-1

      dsa · python-cryptography · debian · bookworm; dsa · python-cryptography · debian · 12

  • Source package: [python-cryptography]

    Details (2)
    • 38.0.4-3+deb12u1 · all · bookworm

      Fixed · Fixed: 3.2.1-1

      dsa · python-cryptography · debian · bookworm; dsa · python-cryptography · debian · 12

    • 38.0.4-3+deb12u1 · all · bookworm

      Fixed · Fixed: 3.2.1-1

      dsa · python-cryptography · debian · bookworm; dsa · python-cryptography · debian · 12

[Debian 13 (Trixie)]

  • Source package: [python-cryptography]

    Details (2)
    • 43.0.0-3+deb13u1 · amd64 · trixie

      Fixed · Fixed: 3.2.1-1

      dsa · python-cryptography · debian · 13

    • 43.0.0-3+deb13u1 · arm64 · trixie

      Fixed · Fixed: 3.2.1-1

      dsa · python-cryptography · debian · 13

  • Source package: [python-cryptography]

    Details (2)
    • 43.0.0-3+deb13u1 · all · trixie

      Fixed · Fixed: 3.2.1-1

      dsa · python-cryptography · debian · 13

    • 43.0.0-3+deb13u1 · all · trixie

      Fixed · Fixed: 3.2.1-1

      dsa · python-cryptography · debian · 13

Observed:

References