GHSA-3ww4-gg4f-jr7fHighCVSS 7.5

Python Cryptography package vulnerable to Bleichenbacher timing oracle attack

Published
February 5, 2024
Last Modified
March 25, 2026

🔗 CVE IDs covered (1)

📋 Description

A flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data.

🎯 Affected products1

  • pip/cryptography:< 42.0.0

🔗 References (6)