CVE-2020-25657: 
CBL Mariner vulnerability analysis and mitigation

A flaw was discovered in all released versions of m2crypto, making them vulnerable to Bleichenbacher timing attacks in the RSA decryption API through the timed processing of valid PKCS#1 v1.5 Ciphertext. This vulnerability was assigned CVE-2020-25657 and was first reported on September 16, 2020 (CVE Details).

The vulnerability has been assigned a CVSS v3.1 base score of 5.9 (Medium) with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N. The vulnerability specifically affects the RSA decryption API and is related to timing-based attacks that could potentially compromise the confidentiality of encrypted communications (NVD).

The primary impact of this vulnerability is on confidentiality, with no direct effect on integrity or availability. The vulnerability could potentially allow attackers to decrypt RSA-encrypted data through timing analysis of the decryption process (Red Hat Bugzilla).

The vulnerability requires network access but no authentication or user interaction. However, it has a high attack complexity, making successful exploitation challenging. There are no public reports of this vulnerability being exploited in the wild (NVD).

The issue has been addressed through security updates, with fixed versions available in various distributions. For example, Debian has fixed the vulnerability in versions 0.38.0-4 and later. Red Hat has addressed this issue through RHSA-2021:1169 for affected products (Debian Tracker, Red Hat Advisory).