CVE-2023-52323

What it actually does

PyCryptodome and pycryptodomex versions before the fix contain a timing side-channel in RSA OAEP decryption. When an application exposes an RSA-OAEP decryption operation to an attacker and returns observable differences, the attacker may be able to use a Manger-style adaptive chosen-ciphertext attack to recover confidential plaintext from captured RSA-OAEP ciphertexts. The issue affects confidentiality only; it does not directly permit code execution, privilege escalation, or service disruption. Exploitation is technically difficult because it requires many decryption attempts, reliable timing or behavioral observations, and an application design that exposes a decryption oracle.

Why it matters to the business

Systems that use affected PyCryptodome or pycryptodomex versions for RSA-OAEP decryption could leak sensitive encrypted data under specific conditions. The most relevant risk is exposure of secrets such as session keys, tokens, credentials, or protected messages if an attacker can repeatedly submit crafted ciphertexts and observe decryption behavior. The CVSS score is moderate and EPSS is low, with no known KEV listing or public exploit maturity reported, so this is not typically an emergency patch unless the library is used in externally reachable cryptographic services, authentication flows, secure messaging, or key-unwrapping functionality.

How an attack unfolds

An attacker first identifies an application endpoint, protocol service, or API feature that accepts RSA-OAEP ciphertexts and attempts to decrypt them using a vulnerable PyCryptodome or pycryptodomex version. The attacker then submits carefully modified ciphertexts and observes whether decryption behavior differs through timing, error handling, response content, connection handling, or other side effects. By repeating this process many times, the attacker can use the observable side channel as a decryption oracle and perform a Manger attack to progressively recover information about the original plaintext. Successful exploitation depends heavily on the attacker’s ability to make a large number of adaptive requests with sufficiently stable measurements and on the application not masking timing and error differences.

How to fix it

Upgrade PyCryptodome and pycryptodomex to version 3.19.1 or later wherever RSA-OAEP decryption may be used. For source builds from the legrandin/pycryptodome Git repository, ensure the code includes commit ed0c1ec63eb22dbe33b637bed381370a50e892bb or a later release containing the fix. Rebuild and redeploy all applications, containers, serverless packages, and virtual environments that vendor or pin the vulnerable dependency. If immediate upgrade is not possible, reduce exploitability by preventing untrusted users from accessing RSA-OAEP decryption functions, rate-limiting decryption attempts, normalizing error responses, avoiding detailed cryptographic error messages, and using protocol-level designs that do not expose raw decryption oracles. These mitigations should be treated as temporary; the library upgrade is the primary fix.

How to confirm the fix worked

Confirm dependency versions using package inventory and runtime checks, such as `pip show pycryptodome pycryptodomex`, lockfiles, SBOMs, container image scans, and application build manifests. Validate that all deployed environments use PyCryptodome or pycryptodomex 3.19.1 or later, or contain the fixed Git commit ed0c1ec63eb22dbe33b637bed381370a50e892bb. Review application code for RSA-OAEP decryption usage, especially imports from `Crypto.Cipher.PKCS1_OAEP` or `Cryptodome.Cipher.PKCS1_OAEP`, and verify that untrusted callers cannot perform unrestricted decryption attempts. Functional testing should confirm that cryptographic failure responses are generic and rate-limited, but this does not replace verifying the patched dependency version.

Typical attack path

1. Identify an application or service that performs RSA-OAEP decryption using PyCryptodome or pycryptodomex before 3.19.1.
2. Obtain or capture a target RSA-OAEP ciphertext whose plaintext is valuable, such as a wrapped key or encrypted secret.
3. Send crafted variants of the ciphertext to the decryption interface repeatedly.
4. Measure observable differences such as response timing, error messages, status codes, connection resets, or other decryption outcomes.
5. Use the responses as an oracle in an adaptive Manger-style attack to narrow the possible plaintext values.
6. Recover the protected plaintext if the oracle is reliable enough and sufficient queries are possible.

How to detect it

Because this is a side-channel vulnerability, exploitation may leave little or no direct artifact beyond application access patterns and cryptographic failure logs. Review application, API gateway, web server, WAF, and service logs for high volumes of requests to endpoints that perform RSA-OAEP decryption, especially repeated failures, malformed ciphertext submissions, unusual request sizes, or many near-identical requests with small changes. Look for spikes in exceptions or errors related to OAEP, RSA decryption, padding validation, invalid ciphertext length, or incorrect decryption. If detailed timing telemetry is available, investigate clients generating many decryption failures with tightly controlled request intervals, as adaptive chosen-ciphertext attacks often require repeated oracle queries. For forensic review, correlate suspect client IPs, user agents, API keys, and authentication principals with decryption-error bursts and any subsequent access to sensitive data or key material. There are no widely known malware filenames, commands, registry artifacts, or network signatures specific to this CVE.

• ValueError: Incorrect decryption.
• ValueError: Ciphertext with incorrect length.
• Incorrect decryption
• Ciphertext with incorrect length
• Crypto.Cipher.PKCS1_OAEP
• Cryptodome.Cipher.PKCS1_OAEP
• PKCS1_OAEP.decrypt
• OAEP decryption failed
• RSA decryption failed
• invalid ciphertext
• invalid padding

What your security team should do

• Inventory all uses of PyCryptodome and pycryptodomex across applications, containers, build pipelines, and vendored dependencies.
• Prioritize upgrades for internet-facing services, APIs, authentication systems, secure messaging components, and key-management workflows that perform RSA-OAEP decryption.
• Upgrade affected packages to PyCryptodome or pycryptodomex 3.19.1 or later, or ensure source builds include commit ed0c1ec63eb22dbe33b637bed381370a50e892bb.
• Search codebases for RSA-OAEP decryption usage and assess whether any endpoint could act as a decryption oracle for untrusted input.
• Add or verify rate limiting, generic error handling, and monitoring for repeated cryptographic decryption failures.
• Review logs for unusual volumes of failed OAEP/RSA decryption attempts, especially from single clients or distributed sources over short time windows.
• Track this as a confidentiality risk rather than a remote code execution issue; remediation urgency should be highest where encrypted secrets or key-wrapping operations are exposed to attackers.