Safety vulnerability ID: 38414
The information on this page was manually curated by our Cybersecurity Intelligence Team.
Rsa 4.3 includes a fix for CVE-2020-13757: Python-RSA before 4.3 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.g., by helping an attacker to infer that an application uses Python-RSA, or if the length of accepted ciphertext affects application behavior (such as by causing excessive memory allocation).
Latest version: 4.9
Pure-Python RSA implementation
support Python 2.7. This is now made explicit in the `python_requires` argument
in `setup.py`. Python 3.4 is not supported by this release.
Two security fixes have also been backported, so 4.3 = 4.0 + these two fixes.
- Choose blinding factor relatively prime to N. Thanks Christian Heimes for pointing this out.
- Reject cyphertexts (when decrypting) and signatures (when verifying) that have
been modified by prepending zero bytes. This resolves CVE-2020-13757. Thanks
Carnil for pointing this out.
Scan your Python project for dependency vulnerabilities in two minutes
Scan your application