CVE-2020-26263 is a high-severity side-channel vulnerability affecting tlslite-ng, an open-source Python library for SSL/TLS. The flaw lies in the RSA PKCS#1 v1.5 decryption process, where data-dependent timing differences can leak information about the decrypted ciphertext, impacting TLS servers using RSA key exchange or applications directly using the RSA decryption API. With a CVSS score of 7.5, this vulnerability allows for high confidentiality impact with low attack complexity and no user interaction required. While patches exist in versions 0.7.6 and 0.8.0-alpha39, their side-channel resistance is limited due to Python's byte processing. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 0.7.6CPE matchmatch criteria | cpe:2.3:a:tlslite-ng_project:tlslite-ng:*:*:*:*:*:*:*:* | ||
0.8.0CPE matchmatch criteria | cpe:2.3:a:tlslite-ng_project:tlslite-ng:0.8.0:alpha1:*:*:*:*:*:* | ||
0.8.0CPE matchmatch criteria | cpe:2.3:a:tlslite-ng_project:tlslite-ng:0.8.0:alpha10:*:*:*:*:*:* | ||
0.8.0CPE matchmatch criteria | cpe:2.3:a:tlslite-ng_project:tlslite-ng:0.8.0:alpha11:*:*:*:*:*:* | ||
0.8.0CPE matchmatch criteria | cpe:2.3:a:tlslite-ng_project:tlslite-ng:0.8.0:alpha12:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.