CVE-2020-26263: 
Python vulnerability analysis and mitigation

CVE-2020-26263 affects tlslite-ng, an open source Python library that implements SSL and TLS cryptographic protocols. The vulnerability was discovered in versions before 0.7.6 and 0.8.0-alpha39, where the RSA PKCS#1 v1.5 decryption implementation contained data-dependent operations that could leak information about decrypted ciphertext. The issue was disclosed on December 21, 2020 (NVD).

The vulnerability exists in the code that performs decryption and padding check in RSA PKCS#1 v1.5 decryption. The implementation aborts processing as soon as the plaintext doesn't start with 0x00, 0x02, creating timing variations that leak information about the decrypted ciphertext. The vulnerability has a CVSS v3.1 Base Score of 7.5 HIGH (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) (NVD, GitHub Advisory).

All TLS servers that enable RSA key exchange and applications that use the RSA decryption API directly are vulnerable to information leakage through timing side-channels. The vulnerability could potentially allow attackers to decrypt parts of the ciphertext through timing analysis (GitHub Advisory).

The vulnerability was patched in versions 0.7.6 and 0.8.0-alpha39. However, due to Python's inherent limitations in handling side-channel-free operations, users requiring strong side-channel resistance are recommended to use alternative TLS implementations, as stated in the security policy of tlslite-ng (GitHub Advisory).