CVE-2026-69247

Full vulnerability record from the local CVENow database.

Description

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 44.0.0 until 50.0.0, pkcs7_decrypt_der, pkcs7_decrypt_pem, and pkcs7_decrypt_smime reported the outcome of decrypting a RecipientInfo's encryptedKey in several distinguishable ways, one of which disclosed the exact length recovered from the RSA operation. The same distinction was also observable by timing. An application that decrypts attacker-supplied EnvelopedData and reflects the outcome gives the attacker a Bleichenbacher oracle against the content-encryption key. Decryption ran as RSA PKCS#1 v1.5 decrypt of encryptedKey, build an AES cipher from the result, then AES-CBC decrypt and PKCS#7 unpad. Invalid RSA padding, a valid padding with a bad key length, a correct length with a wrong key, and the real key each failed or succeeded differently. Case 1 is reachable only where the linked library lacks implicit rejection: OpenSSL 3.0 and 3.1, LibreSSL, and BoringSSL. Exploitation requires a service that auto-decrypts untrusted EnvelopedData matching the victim certificate and answers adaptively at high volume, such as an S/MIME gateway or mail filter. This issue is fixed in 50.0.0.

Severity

HIGH

CVSS score

8.2 (v4.0)

Vulnerability status

Awaiting Analysis

Source identifier

[email protected]

Published

2026-08-03 22:16:52.380000

Last modified

2026-10-23 21:10:00.157000

View original CVE JSON

{
  "id": "CVE-2026-69247",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-03T22:16:52.380",
  "lastModified": "2026-10-23T21:10:00.157",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 44.0.0 until 50.0.0, pkcs7_decrypt_der, pkcs7_decrypt_pem, and pkcs7_decrypt_smime reported the outcome of decrypting a RecipientInfo's encryptedKey in several distinguishable ways, one of which disclosed the exact length recovered from the RSA operation. The same distinction was also observable by timing. An application that decrypts attacker-supplied EnvelopedData and reflects the outcome gives the attacker a Bleichenbacher oracle against the content-encryption key. Decryption ran as RSA PKCS#1 v1.5 decrypt of encryptedKey, build an AES cipher from the result, then AES-CBC decrypt and PKCS#7 unpad. Invalid RSA padding, a valid padding with a bad key length, a correct length with a wrong key, and the real key each failed or succeeded differently. Case 1 is reachable only where the linked library lacks implicit rejection: OpenSSL 3.0 and 3.1, LibreSSL, and BoringSSL. Exploitation requires a service that auto-decrypts untrusted EnvelopedData matching the victim certificate and answers adaptively at high volume, such as an S/MIME gateway or mail filter. This issue is fixed in 50.0.0."
    },
    {
      "lang": "es",
      "value": "Criptografía es un paquete diseñado para exponer primitivas criptográficas y recetas a desarrolladores de Python. Desde la versión 44.0.0 hasta la 50.0.0, pkcs7_decrypt_der, pkcs7_decrypt_pem y pkcs7_decrypt_smime informaron el resultado del descifrado de la encryptedKey de un RecipientInfo de varias maneras distinguibles, una de las cuales reveló la longitud exacta recuperada de la operación RSA. La misma distinción también era observable por temporización. Una aplicación que descifra EnvelopedData suministrada por el atacante y refleja el resultado le da al atacante un oráculo de Bleichenbacher contra la clave de cifrado de contenido. El descifrado se ejecutó como descifrado RSA PKCS#1 v1.5 de encryptedKey, se construyó un cifrador AES a partir del resultado, luego descifrado AES-CBC y desacolchado PKCS#7. El relleno RSA inválido, un relleno válido con una longitud de clave incorrecta, una longitud correcta con una clave errónea y la clave real, cada uno falló o tuvo éxito de manera diferente. El Caso 1 es alcanzable solo donde la biblioteca enlazada carece de rechazo implícito: OpenSSL 3.0 y 3.1, LibreSSL y BoringSSL. La explotación requiere un servicio que descifra automáticamente EnvelopedData no confiable que coincida con el certificado de la víctima y responde de forma adaptativa a gran volumen, como una pasarela S/MIME o un filtro de correo. Este problema está solucionado en la versión 50.0.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "pyca",
          "product": "cryptography",
          "versions": [
            {
              "version": ">= 44.0.0, < 50.0.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 8.2,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-04T14:09:18.204828Z",
          "id": "CVE-2026-69247",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-208"
        },
        {
          "lang": "en",
          "value": "CWE-209"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/pyca/cryptography/commit/53fccd93413a8d7f07d6d8999681f27b75cffa3f",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/pyca/cryptography/pull/15369",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/pyca/cryptography/security/advisories/GHSA-g6cj-pr64-35w5",
      "source": "[email protected]"
    }
  ]
}