Bug 1178829 (CVE-2020-25657) - VUL-0: CVE-2020-25657: python-m2crypto,python-M2Crypto: Bleichenbacher timing attacks in the RSA decryption API
Summary: VUL-0: CVE-2020-25657: python-m2crypto,python-M2Crypto: Bleichenbacher timing...
Status: RESOLVED FIXED
Alias: CVE-2020-25657
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P2 - High : Major
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/271663/
Whiteboard: CVSSv3.1:SUSE:CVE-2020-25657:7.5:(AV:...
Keywords:
Depends on:
Blocks:
 
Reported: 2020-11-16 10:22 UTC by Wolfgang Frisch
Modified: 2024-07-19 12:33 UTC (History)
11 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Wolfgang Frisch 2020-11-16 10:22:43 UTC
CVE-2020-25657

All released versions of m2crypto are vulnerable to Bleichenbacher timing attacks in the RSA decryption API, via timed processing of valid PKCS#1 v1.5 ciphertext.

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1889823
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-25657
https://access.redhat.com/security/cve/CVE-2020-25657
Comment 5 Andreas Taschner 2022-03-11 07:26:34 UTC
Ping
Comment 6 Matej Cepl 2022-05-24 10:04:49 UTC
First of all, let me apologize for the lack of communication here.

Second, this bug is really problematic. See the upstream ticket for the discussion, but my conclusion is that there is really not proper solution for this, and especially that whatever solution there could be depends first on OpenSSL (M2Crypto is really just rather thin wrapper over it). What pyca did in https://github.com/pyca/cryptography/commit/58494b41d6ec seems to me like a window dressing at best (and they admit it themselves in the Changelog). So, either I can try to do the same in M2Crypto or this bug just go WONTFIX until proper solution is found.

Reassigning to the Security for further evaluation.
Comment 7 Matej Cepl 2022-05-24 10:07:54 UTC
Oh, I forgot to add (damn, I would like bugzilla to have Edit button for comments even more than Twitter!), that of course, the solution proposed by pyca changes API of M2Crypto, which is highly problematic for the library which is mostly oriented on supporting legacy applications.
Comment 10 Kristyna Streitova 2022-06-13 16:29:55 UTC
It seems that they tried to address it within OpenSSL but the issue is still open:

https://github.com/openssl/openssl/issues/13421

From what I can see the upstream doesn't have any proper solution and most of the distributions are still vulnerable.

@security-team, can you please help here? We should decide how to treat this situation where there is no reasonable solution and no upstream patch available. 

Thanks!
Comment 11 Kristyna Streitova 2022-06-15 09:43:42 UTC
There is an opened PR for OpenSSL upstream [1] that changes the RSA_private_decrypt() API in a way that makes it no longer possible to mount a Bleichenbacher attack on the private key based on the errors reported by the API call.

According to the discussion in that PR, it looks promising and it's possible that it will be accepted to OpenSSL but I'm not sure if they accept this change to OpenSSL 1.1.1 as well as it's changing the API (even though there is disagreement on that between the PR author and OpenSSL upstream). So it's a question if this would be safe for us to backport or not.

I'm adding Jason to the CC.

[1] https://github.com/openssl/openssl/pull/13817
Comment 12 Matej Cepl 2022-07-13 05:51:49 UTC
We have decided in the end to at least reimplement the cryptography solution, merged upstream and in Factory as https://build.opensuse.org/request/show/988816.
Comment 16 Matej Cepl 2022-07-18 14:24:00 UTC
(In reply to Kristyna Streitova from comment #11)
> [1] https://github.com/openssl/openssl/pull/13817

Based on the private conversation with the upstream OpenSSL developer, he doesn’t know when and whether this PR will be ever merged, and it certainly won’t happen for any stable branch.
Comment 17 Swamp Workflow Management 2022-07-22 13:16:50 UTC
SUSE-SU-2022:2527-1: An update that fixes one vulnerability is now available.

Category: security (important)
Bug References: 1178829
CVE References: CVE-2020-25657
JIRA References: 
Sources used:
SUSE OpenStack Cloud Crowbar 9 (src):    python-M2Crypto-0.29.0-23.8.1
SUSE OpenStack Cloud 9 (src):    python-M2Crypto-0.29.0-23.8.1
SUSE Linux Enterprise Server for SAP 12-SP4 (src):    python-M2Crypto-0.29.0-23.8.1
SUSE Linux Enterprise Server 12-SP5 (src):    python-M2Crypto-0.29.0-23.8.1
SUSE Linux Enterprise Server 12-SP4-LTSS (src):    python-M2Crypto-0.29.0-23.8.1
SUSE Linux Enterprise Server 12-SP3-BCL (src):    python-M2Crypto-0.29.0-23.8.1
SUSE Linux Enterprise Server 12-SP2-BCL (src):    python-M2Crypto-0.29.0-23.8.1
SUSE Linux Enterprise Module for Public Cloud 12 (src):    python-M2Crypto-0.29.0-23.8.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 18 Swamp Workflow Management 2022-07-22 19:23:39 UTC
SUSE-SU-2022:2532-1: An update that fixes one vulnerability is now available.

Category: security (important)
Bug References: 1178829
CVE References: CVE-2020-25657
JIRA References: 
Sources used:
openSUSE Leap 15.4 (src):    python-M2Crypto-0.38.0-150400.3.3.1
SUSE Linux Enterprise Module for Basesystem 15-SP4 (src):    python-M2Crypto-0.38.0-150400.3.3.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 19 Swamp Workflow Management 2022-07-27 16:23:55 UTC
SUSE-SU-2022:2562-1: An update that fixes one vulnerability is now available.

Category: security (important)
Bug References: 1178829
CVE References: CVE-2020-25657
JIRA References: 
Sources used:
openSUSE Leap 15.4 (src):    python-M2Crypto-0.35.2-150000.3.14.1
openSUSE Leap 15.3 (src):    python-M2Crypto-0.35.2-150000.3.14.1
SUSE Manager Server 4.1 (src):    python-M2Crypto-0.35.2-150000.3.14.1
SUSE Manager Retail Branch Server 4.1 (src):    python-M2Crypto-0.35.2-150000.3.14.1
SUSE Manager Proxy 4.1 (src):    python-M2Crypto-0.35.2-150000.3.14.1
SUSE Linux Enterprise Server for SAP 15-SP2 (src):    python-M2Crypto-0.35.2-150000.3.14.1
SUSE Linux Enterprise Server for SAP 15-SP1 (src):    python-M2Crypto-0.35.2-150000.3.14.1
SUSE Linux Enterprise Server for SAP 15 (src):    python-M2Crypto-0.35.2-150000.3.14.1
SUSE Linux Enterprise Server 15-SP2-LTSS (src):    python-M2Crypto-0.35.2-150000.3.14.1
SUSE Linux Enterprise Server 15-SP2-BCL (src):    python-M2Crypto-0.35.2-150000.3.14.1
SUSE Linux Enterprise Server 15-SP1-LTSS (src):    python-M2Crypto-0.35.2-150000.3.14.1
SUSE Linux Enterprise Server 15-SP1-BCL (src):    python-M2Crypto-0.35.2-150000.3.14.1
SUSE Linux Enterprise Server 15-LTSS (src):    python-M2Crypto-0.35.2-150000.3.14.1
SUSE Linux Enterprise Module for Python2 15-SP3 (src):    python-M2Crypto-0.35.2-150000.3.14.1
SUSE Linux Enterprise Module for Public Cloud 15 (src):    python-M2Crypto-0.35.2-150000.3.14.1
SUSE Linux Enterprise Module for Basesystem 15-SP3 (src):    python-M2Crypto-0.35.2-150000.3.14.1
SUSE Linux Enterprise Micro 5.2 (src):    python-M2Crypto-0.35.2-150000.3.14.1
SUSE Linux Enterprise Micro 5.1 (src):    python-M2Crypto-0.35.2-150000.3.14.1
SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (src):    python-M2Crypto-0.35.2-150000.3.14.1
SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (src):    python-M2Crypto-0.35.2-150000.3.14.1
SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (src):    python-M2Crypto-0.35.2-150000.3.14.1
SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (src):    python-M2Crypto-0.35.2-150000.3.14.1
SUSE Linux Enterprise High Performance Computing 15-LTSS (src):    python-M2Crypto-0.35.2-150000.3.14.1
SUSE Linux Enterprise High Performance Computing 15-ESPOS (src):    python-M2Crypto-0.35.2-150000.3.14.1
SUSE Enterprise Storage 7 (src):    python-M2Crypto-0.35.2-150000.3.14.1
SUSE Enterprise Storage 6 (src):    python-M2Crypto-0.35.2-150000.3.14.1
SUSE CaaS Platform 4.0 (src):    python-M2Crypto-0.35.2-150000.3.14.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 22 OBSbugzilla Bot 2022-08-03 18:40:02 UTC
This is an autogenerated message for OBS integration:
This bug (1178829) was mentioned in
https://build.opensuse.org/request/show/992616 Factory / python-M2Crypto
Comment 26 Swamp Workflow Management 2022-08-05 19:16:27 UTC
SUSE-SU-2022:2691-1: An update that fixes one vulnerability is now available.

Category: security (important)
Bug References: 1178829
CVE References: CVE-2020-25657
JIRA References: 
Sources used:
openSUSE Leap 15.4 (src):    python-M2Crypto-0.38.0-150400.3.6.1
SUSE Linux Enterprise Module for Basesystem 15-SP4 (src):    python-M2Crypto-0.38.0-150400.3.6.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 27 Swamp Workflow Management 2022-09-01 13:54:14 UTC
openSUSE-SU-2022:2562-1: An update that fixes one vulnerability is now available.

Category: security (important)
Bug References: 1178829
CVE References: CVE-2020-25657
JIRA References: 
Sources used:
openSUSE Leap Micro 5.2 (src):    python-M2Crypto-0.35.2-150000.3.14.1
Comment 35 Andrea Mattiazzo 2024-07-19 12:33:02 UTC
All done, closing.