CVE-2023-50781: m2crypto Bleichenbacher timing attack in RSA decryption API

CVE-2023-50781 · Severity: high · CVSS 7.5 · Published 2024-02-05

A security flaw has been identified in m2crypto, a library used by various software applications to handle encrypted communications. This vulnerability could allow a remote attacker to decrypt sensitive data sent over the network by exploiting a timing-based weakness in how the system handles certain encryption keys. If exploited, confidential information such as login credentials or private messages could be exposed to unauthorized parties.

Technologies: Red Hat Enterprise Linux 8.0, Red Hat Enterprise Linux 9.0, Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem. Vendors: PyPI, Red Hat, Siemens.

Quick answers

Is CVE-2023-50781 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2023-50781 being exploited in the wild.
How severe is CVE-2023-50781?
High severity, with a CVSS score of 7.5, published 5 February 2024.
Which products and versions are affected?
M2Crypto Project M2Crypto -; m2crypto (PyPI) ECOSYSTEM:introduced=0,last_affected=0.40.1; Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem All versions.
Is there a fix for CVE-2023-50781?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2023-50781 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2023-50781?
Check whether you run M2Crypto Project M2Crypto, m2crypto (PyPI), Red Hat Enterprise Linux 8.0 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

m2crypto is vulnerable to a Bleichenbacher-style timing attack (Marvin Attack) due to an incomplete fix for CVE-2020-25657. The vulnerability exists in the RSA decryption API when PKCS#1 v1.5 padding is used, where observable discrepancies in processing time (CWE-203) allow an attacker to perform side-channel analysis. A remote, unauthenticated attacker can capture TLS traffic and iteratively query the server to eventually decrypt the ciphertext. Because the issue is rooted in the API design, a full fix within the library is difficult; mitigation involves using a cryptographic backend that implements implicit rejection or avoiding RSA key exchanges in favor of modern alternatives like ECDHE.

Affected products

  • m2crypto project m2crypto -
  • Red Hat Enterprise Linux 8.0
  • Red Hat Enterprise Linux 9.0
  • Red Hat Update Infrastructure 4
  • Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem All versions

Identifiers

  • CVE-2023-50781
  • GHSA-944j-8ch6-rf6x
  • PYSEC-2026-1595

Timeline

  • 2023-12-13: disclosed: Bug reported to Red Hat Bugzilla
  • 2024-02-05: advisory: NVD publication date
  • 2024-04-09: advisory: Siemens advisory published including this CVE

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.