Observable Timing Discrepancy Affecting pycryptodomex package, versions [,3.19.1)
Threat Intelligence
EPSS
0.09% (38th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-PYCRYPTODOMEX-6145008
- published 5 Jan 2024
- disclosed 5 Jan 2024
- credit Hubert Kario
Introduced: 5 Jan 2024
CVE-2023-52323 Open this link in a new tabHow to fix?
Upgrade pycryptodomex to version 3.19.1 or higher.
Overview
pycryptodomex is a Cryptographic library for Python
Affected versions of this package are vulnerable to Observable Timing Discrepancy due to improper handling of OAEP decryption. An attacker can extract sensitive information by exploiting the side-channel leakage to perform a Manger attack (Marvin).
References
CVSS Scores
version 3.1