CVE-2020-26263

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2020-26263
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-26263.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2020-26263
Aliases
Downstream
Related
Published
2020-12-21T17:15:12.637Z
Modified
2026-04-10T04:25:25.489117Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
[none]
Details

tlslite-ng is an open source python library that implements SSL and TLS cryptographic protocols. In tlslite-ng before versions 0.7.6 and 0.8.0-alpha39, the code that performs decryption and padding check in RSA PKCS#1 v1.5 decryption is data dependant. In particular, the code has multiple ways in which it leaks information about the decrypted ciphertext. It aborts as soon as the plaintext doesn't start with 0x00, 0x02. All TLS servers that enable RSA key exchange as well as applications that use the RSA decryption API directly are vulnerable. This is patched in versions 0.7.6 and 0.8.0-alpha39. Note: the patches depend on Python processing the individual bytes in side-channel free manner, this is known to not the case (see reference). As such, users that require side-channel resistance are recommended to use different TLS implementations, as stated in the security policy of tlslite-ng.

References

Affected packages

Git / github.com/tlsfuzzer/tlslite-ng

Affected ranges

Type
GIT
Repo
https://github.com/tlsfuzzer/tlslite-ng
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
c28d6d387bba59d8bd5cb3ba15edc42edf54b368
Type
GIT
Repo
https://github.com/tomato42/tlslite-ng
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
cc8fa0b3c3a49d85b8a5f4c2643f99bcd11de4d8
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
ddaf97b06e14603617a8fe35e6039f9bf6070381
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
3b9ead628e2513be87f92b714a4a1b097ed00576
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
ac9c99a59c3c51abbd6909e76415c6306c3e45d8
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
d85eb752aeb37bc5b02834570d3cb5bab4c8a9df
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
777b4e2ac0e88b2589cb3303839c748ab6095fe2
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
7da1a3f726dfbf3ec8ed425b7e098409705b68cf
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
035e5b5a4e79a2454db2fc1e9d7b9f512874699d
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
1464d8dc0e29ad50a6d71c4d579f7afa933baaaf
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
02852484e5ca9ea5e0c69d525ff45a3a999b386b
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
bc93aa17317f4f3765558cf36249d446b1838987
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
af466651a7795ac5a6cf54932d496ca8e79b49bf
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
69fc79f77e2165e35ca4395fd29843190df74112
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
21cebf51b7acf9b6f6313b40b73716adaf344ac7
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
460adb1b2ffd3170ba7670b0e7dd9c24d702e4d1
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
2a1e00a845dd1d7adc3d74abab40964722bab4f5
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
8243cf3140501c7d077cfcdefcef7e3e16cec14c
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
d61527a01aa92f4ccdcb05316dfbe9b2f20e9882
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
76007d5e0bd8c69bb85aad635d06588f7aaae5f6
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
029425144f6b26d5ab8acc3a79e3ead79253ad71
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
401712ca8ea16093933991e67d39a344bc1dc627
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
eb7f6df192c9715fd9b406f8bdbd134c5699cb4c
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
75dbe54e822f8007c41f90ddc0645cb5aa232bc0
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
6498e79f43b6c1ff9ffc0e93f3d781aebdf993bd
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
807baaeb3522073cabaf210adf3cf710cd35995e
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
1abaefeef0f842ff897b55c2d5037dc8db63e7b8
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
e671d94974a47d03bba67247553c86a5886176b6
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
ed727a7cc4f3e5664a6279a6a359d9937ae5f751
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
2b1e0ed7fd54045cb270f125306e0f8f872b4798
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
3d3e83a5b500545d53ac33b6775931f7fcd86cc3
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
9396ca0f75fd3d4c84035ca7d36811fe5a2cf025
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
27157e0047ad14f98d1ff24ca0f09a9c31e9d30a
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
c6c9112b2357f062712930b810c3dee462f7576f
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
270684d207425b184bd308ac5f8f5db9dc84256a
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
05778bde61ba0be3c8e3b175ace094e53eabb54a
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
4df30c8c675f7a98b3694d21bb7809cc0abcc5e1
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
2ca8c0c15313c73985866007fc7fdfa102fa6d62
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
0e8a405d063a5b924b6be512513883eb27993eb8
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
2b9c15f697e465e117ff57b89f3ea1537de722e3
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.7.6"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.8.0-alpha1"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.8.0-alpha10"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.8.0-alpha11"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.8.0-alpha12"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.8.0-alpha13"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.8.0-alpha14"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.8.0-alpha15"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.8.0-alpha16"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.8.0-alpha17"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.8.0-alpha18"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.8.0-alpha19"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.8.0-alpha2"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.8.0-alpha20"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.8.0-alpha21"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.8.0-alpha22"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.8.0-alpha23"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.8.0-alpha24"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.8.0-alpha25"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.8.0-alpha26"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.8.0-alpha27"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.8.0-alpha28"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.8.0-alpha29"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.8.0-alpha3"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.8.0-alpha30"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.8.0-alpha31"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.8.0-alpha32"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.8.0-alpha33"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.8.0-alpha34"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.8.0-alpha35"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.8.0-alpha36"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.8.0-alpha37"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.8.0-alpha38"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.8.0-alpha4"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.8.0-alpha5"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.8.0-alpha6"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.8.0-alpha7"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.8.0-alpha8"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.8.0-alpha9"
        }
    ]
}

Affected versions

Other
fork-start
v0.*
v0.3.9x
v0.4.1
v0.4.2
v0.4.3
v0.4.8
v0.5.0
v0.5.0-beta3
v0.5.0-beta4
v0.5.0-beta6
v0.5.1
v0.6.0
v0.6.0-alpha1
v0.6.0-alpha2
v0.6.0-alpha3
v0.6.0-alpha4
v0.6.0-alpha5
v0.6.0-beta1
v0.7.0
v0.7.0-alpha1
v0.7.0-alpha2
v0.7.0-alpha3
v0.7.0-alpha4
v0.7.0-alpha5
v0.7.0-alpha6
v0.7.0-alpha7
v0.7.0-alpha8
v0.7.0-alpha9
v0.7.0-beta1
v0.7.1
v0.7.2
v0.7.3
v0.7.4
v0.7.5
v0.8.0-alpha1
v0.8.0-alpha10
v0.8.0-alpha11
v0.8.0-alpha12
v0.8.0-alpha13
v0.8.0-alpha14
v0.8.0-alpha15
v0.8.0-alpha16
v0.8.0-alpha17
v0.8.0-alpha18
v0.8.0-alpha19
v0.8.0-alpha2
v0.8.0-alpha20
v0.8.0-alpha21
v0.8.0-alpha22
v0.8.0-alpha23
v0.8.0-alpha24
v0.8.0-alpha25
v0.8.0-alpha26
v0.8.0-alpha27
v0.8.0-alpha28
v0.8.0-alpha29
v0.8.0-alpha3
v0.8.0-alpha30
v0.8.0-alpha31
v0.8.0-alpha32
v0.8.0-alpha33
v0.8.0-alpha34
v0.8.0-alpha35
v0.8.0-alpha36
v0.8.0-alpha37
v0.8.0-alpha38
v0.8.0-alpha4
v0.8.0-alpha5
v0.8.0-alpha6
v0.8.0-alpha7
v0.8.0-alpha8
v0.8.0-alpha9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-26263.json"