{"action":"Upgrade rsa to 4.1 or later.","affected":[{"fixed":"4.1","introduced":"0"}],"component":"rsa","cve_ids":["CVE-2020-13757"],"ecosystem":"PyPI","epss":0.01421,"exploited":false,"fixed_versions":["4.1"],"ghsa_id":"GHSA-537h-rv9q-vvph","id":"tcs_01M5KGB07V9KHMVVH6BRXAZ2DD","modified_at":"2023-11-08T04:02:21.687509Z","published_at":"2020-06-01T19:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2020-99","https://github.com/sybrenstuvel/python-rsa/issues/146","https://github.com/sybrenstuvel/python-rsa/issues/146#issuecomment-641845667","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2KILTHBHNSDUCYV22ODLOKTICJJ7JQIQ/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZYB65VNILRBTXL6EITQTH2PZPK7I23MW/","https://usn.ubuntu.com/4478-1/","https://github.com/advisories/GHSA-537h-rv9q-vvph"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"PYSEC-2020-99","url":"https://osv.dev/vulnerability/PYSEC-2020-99"},{"source":"nvd","source_id":"CVE-2020-13757","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13757"}],"summary":"Python-RSA before 4.1 ignores leading '\\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.g., by helping an attacker to infer that an application uses"}