Executive brief
A vulnerability in the 'cryptography' Python library could allow an attacker to decrypt sensitive data without knowing the correct password or key. This affects systems that automatically process encrypted emails or files, such as secure email gateways. If exploited, an attacker could eventually recover the secret keys used to protect corporate communications.
Technical details
The functions pkcs7_decrypt_der, pkcs7_decrypt_pem, and pkcs7_decrypt_smime fail to implement RFC 3218 mitigations, leading to a Bleichenbacher oracle. The implementation leaks information through distinguishable error messages and timing differences during the RSA PKCS#1 v1.5 decryption of the 'encryptedKey' field. Specifically, the library distinguishes between invalid RSA padding, incorrect key lengths, and padding errors in the subsequent AES-CBC decryption. This allows a remote attacker to perform a chosen-ciphertext attack to recover the content-encryption key. The vulnerability is fixed in version 50.0.0 by ensuring all decryption paths perform identical work and return uniform error responses.
Affected products
- pyca cryptography >= 44.0.0, < 50.0.0
Timeline
- 2026-07-31: disclosed
- 2026-08-03: advisory
- 2026-08-03: patched