Fluid Attacks Database

Description

PyCryptodome and pycryptodomex side-channel leakage for OAEP decryption PyCryptodome and pycryptodomex before 3.19.1 allow side-channel leakage for OAEP decryption, exploitable for a Manger attack.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
rpm rhel8	resource-agents	<0:4.9.0-54.el8	0:4.9.0-54.el8
rpm rhel7	resource-agents	-	-
pypi	pycryptodomex	>=0 <3.19.1	3.19.1
pypi	pycryptodome	>=0 <3.19.1	3.19.1
debian 12	pycryptodome	=3.11.0+dfsg1-4 \|\| =3.18.0+dfsg1-1 \|\| =3.20.0+dfsg-1 \|\| =3.20.0+dfsg-1+loong64 \|\| =3.20.0+dfsg-2 \|\| =3.20.0+dfsg-3	-
debian 13	pycryptodome	>=0 <3.20.0+dfsg-1	3.20.0+dfsg-1
debian 14	pycryptodome	>=0 <3.20.0+dfsg-1	3.20.0+dfsg-1
rpm rhel8.6	fence-agents	<0:4.2.1-89.el8_6.11	0:4.2.1-89.el8_6.11
rpm rhel9.2	fence-agents	<0:4.10.0-43.el9_2.3	0:4.10.0-43.el9_2.3
rpm rhel9.3	fence-agents	<0:4.10.0-55.el9_3.3	0:4.10.0-55.el9_3.3

1-10 of 14

Aliases

1. CVE-2023-523232. NVD-2023-523233. OSV-2023-523234. OSV-DEBIAN-2023-523235. GCVE-2023-523236. SECURITY-TRACKER-CVE-2023-52323

References

1. https://github.com/Legrandin/pycryptodome/commit/0deea1bfe1489e8c80d2053bbb06a1aa0b181ebd2. https://github.com/Legrandin/pycryptodome/blob/master/Changelog.rst3. https://github.com/pypa/advisory-database/tree/main/vulns/pycryptodomex/PYSEC-2024-3.yaml4. https://pypi.org/project/pycryptodomex/#history

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.