{"id":"CVE-2023-52323","aliases":["GHSA-j225-cvw7-qrx7","PYSEC-2024-3","PYSEC-2026-1811"],"title":"PyCryptodome and pycryptodomex side-channel leakage for OAEP decryption","summary":"PyCryptodome and pycryptodomex side-channel leakage for OAEP decryption","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","vendor":"pycryptodomex","product":"pycryptodomex","ecosystem":"pip","affected":["pycryptodomex < 3.19.1","pycryptodome < 3.19.1"],"patched":["pycryptodomex 3.19.1","pycryptodome 3.19.1"],"published":"2024-01-05","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:04.975951117Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-j225-cvw7-qrx7","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52323"},{"url":"https://github.com/Legrandin/pycryptodome/commit/0deea1bfe1489e8c80d2053bbb06a1aa0b181ebd"},{"url":"https://github.com/Legrandin/pycryptodome"},{"url":"https://github.com/Legrandin/pycryptodome/blob/master/Changelog.rst"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pycryptodomex/PYSEC-2024-3.yaml"},{"url":"https://pypi.org/project/pycryptodomex/#history"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-52323.json"},{"url":"https://access.redhat.com/security/cve/CVE-2023-52323"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2257028"},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-52323"},{"url":"https://access.redhat.com/errata/RHSA-2024:1057"},{"url":"https://access.redhat.com/errata/RHSA-2024:2010"},{"url":"https://access.redhat.com/errata/RHSA-2024:2968"},{"url":"https://access.redhat.com/errata/RHBA-2024:1398"},{"url":"https://access.redhat.com/errata/RHBA-2024:1114"},{"url":"https://access.redhat.com/errata/RHSA-2024:1155"},{"url":"https://access.redhat.com/errata/RHBA-2024:1091"},{"url":"https://access.redhat.com/errata/RHBA-2024:1137"},{"url":"https://access.redhat.com/errata/RHSA-2024:2132"},{"url":"https://access.redhat.com/errata/RHSA-2024:2952"}],"tags":["osv","pip","csaf","vex","red-hat"],"epss":0.00618,"epssPercentile":0.47924,"cwe":["CWE-203"],"scores":{"osv":5.3,"vendor":5.9},"ingestedAt":"2026-07-08T18:25:50.513Z","slug":"CVE-2023-52323","body":"## Overview\n\nPyCryptodome and pycryptodomex before 3.19.1 allow side-channel leakage for OAEP decryption, exploitable for a Manger attack.\n\n## Affected packages\n\n- `pycryptodomex < 3.19.1`\n- `pycryptodome < 3.19.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `pycryptodomex 3.19.1`\n- `pycryptodome 3.19.1`\n\n## Vendor advisories\n\n- **RHSA-2024:1057** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.4 for RHEL 8, Red Hat Ansible Automation Platform 2.4 for RHEL 9 · released 2024-02-29 · [advisory](https://access.redhat.com/errata/RHSA-2024:1057)\n- **RHSA-2024:2010** · Red Hat · fixed in: Red Hat Satellite 6.15 for RHEL 8 · released 2024-04-23 · [advisory](https://access.redhat.com/errata/RHSA-2024:2010)\n- **RHSA-2024:2968** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux HighAvailability (v. 8), Red Hat Enterprise Linux ResilientStorage (v. 8) · released 2024-05-22 · [advisory](https://access.redhat.com/errata/RHSA-2024:2968)\n- **RHBA-2024:1398** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream E4S (v.8.4), Red Hat Enterprise Linux AppStream TUS (v.8.4), Red Hat Enterprise Linux High Availability AUS (v.8.4), Red Hat Enterprise Linux HighAvailability E4S (v.8.4), Red Hat Enterprise Linux HighAvailability TUS (v.8.4) · released 2024-03-19 · [advisory](https://access.redhat.com/errata/RHBA-2024:1398)\n- **RHBA-2024:1114** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.8.6), Red Hat Enterprise Linux High Availability EUS (v.8.6), Red Hat Enterprise Linux Resilient Storage EUS (v.8.6) · released 2024-03-05 · [advisory](https://access.redhat.com/errata/RHBA-2024:1114)\n- **RHSA-2024:1155** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.0), Red Hat Enterprise Linux High Availability EUS (v.9.0), Red Hat Enterprise Linux Resilient Storage EUS (v.9.0) · released 2024-03-05 · [advisory](https://access.redhat.com/errata/RHSA-2024:1155)\n- **RHBA-2024:1091** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.2), Red Hat Enterprise Linux High Availability EUS (v.9.2), Red Hat Enterprise Linux Resilient Storage EUS (v.9.2) · released 2024-03-05 · [advisory](https://access.redhat.com/errata/RHBA-2024:1091)\n- **RHBA-2024:1137** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux High Availability (v. 9), Red Hat Enterprise Linux Resilient Storage (v. 9) · released 2024-03-05 · [advisory](https://access.redhat.com/errata/RHBA-2024:1137)\n- **RHSA-2024:2132** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux HighAvailability (v. 9), Red Hat Enterprise Linux ResilientStorage (v. 9) · released 2024-04-30 · [advisory](https://access.redhat.com/errata/RHSA-2024:2132)\n- **RHSA-2024:2952** · Red Hat · fixed in: Red Hat Enterprise Linux HighAvailability (v. 8), Red Hat Enterprise Linux ResilientStorage (v. 8) · released 2024-05-22 · [advisory](https://access.redhat.com/errata/RHSA-2024:2952)\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 7, Red Hat Storage 3 · no fix planned: Red Hat Enterprise Linux 7, Red Hat Storage 3 · updated 2026-09-08 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-52323.json)","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":108719,"id":"CVE-2023-52323","ts":1789182839580,"field":"cvss","old":"5.9","new":"5.3"},{"seq":107636,"id":"CVE-2023-52323","ts":1789182586895,"field":"cvss","old":"5.3","new":"5.9"},{"seq":106499,"id":"CVE-2023-52323","ts":1789180725695,"field":"cvss","old":"5.9","new":"5.3"},{"seq":105362,"id":"CVE-2023-52323","ts":1789178888745,"field":"cvss","old":"5.3","new":"5.9"},{"seq":104225,"id":"CVE-2023-52323","ts":1789176162153,"field":"cvss","old":"5.9","new":"5.3"},{"seq":103088,"id":"CVE-2023-52323","ts":1789175146614,"field":"cvss","old":"5.3","new":"5.9"},{"seq":97613,"id":"CVE-2023-52323","ts":1789162915144,"field":"cvss","old":"5.9","new":"5.3"},{"seq":96616,"id":"CVE-2023-52323","ts":1789160154096,"field":"cvss","old":"5.3","new":"5.9"},{"seq":95617,"id":"CVE-2023-52323","ts":1789158550551,"field":"cvss","old":"5.9","new":"5.3"},{"seq":94611,"id":"CVE-2023-52323","ts":1789156397389,"field":"cvss","old":"5.3","new":"5.9"},{"seq":93603,"id":"CVE-2023-52323","ts":1789154242708,"field":"cvss","old":"5.9","new":"5.3"},{"seq":92589,"id":"CVE-2023-52323","ts":1789152633813,"field":"cvss","old":"5.3","new":"5.9"},{"seq":91654,"id":"CVE-2023-52323","ts":1789150028836,"field":"cvss","old":"5.9","new":"5.3"},{"seq":90719,"id":"CVE-2023-52323","ts":1789148856243,"field":"cvss","old":"5.3","new":"5.9"},{"seq":89643,"id":"CVE-2023-52323","ts":1789145589445,"field":"cvss","old":"5.9","new":"5.3"},{"seq":88602,"id":"CVE-2023-52323","ts":1789145117248,"field":"cvss","old":"5.3","new":"5.9"},{"seq":87545,"id":"CVE-2023-52323","ts":1789141238178,"field":"cvss","old":"5.9","new":"5.3"},{"seq":86473,"id":"CVE-2023-52323","ts":1789137643510,"field":"cvss","old":"5.3","new":"5.9"},{"seq":85411,"id":"CVE-2023-52323","ts":1789136885928,"field":"cvss","old":"5.9","new":"5.3"},{"seq":84329,"id":"CVE-2023-52323","ts":1789133841284,"field":"cvss","old":"5.3","new":"5.9"},{"seq":83268,"id":"CVE-2023-52323","ts":1789132554042,"field":"cvss","old":"5.9","new":"5.3"},{"seq":82197,"id":"CVE-2023-52323","ts":1789130053862,"field":"cvss","old":"5.3","new":"5.9"},{"seq":81146,"id":"CVE-2023-52323","ts":1789128231381,"field":"cvss","old":"5.9","new":"5.3"},{"seq":80095,"id":"CVE-2023-52323","ts":1789126351371,"field":"cvss","old":"5.3","new":"5.9"},{"seq":79078,"id":"CVE-2023-52323","ts":1789123809049,"field":"cvss","old":"5.9","new":"5.3"},{"seq":78061,"id":"CVE-2023-52323","ts":1789122498663,"field":"cvss","old":"5.3","new":"5.9"},{"seq":77003,"id":"CVE-2023-52323","ts":1789119375482,"field":"cvss","old":"5.9","new":"5.3"},{"seq":76016,"id":"CVE-2023-52323","ts":1789118548624,"field":"cvss","old":"5.3","new":"5.9"},{"seq":74944,"id":"CVE-2023-52323","ts":1789114954022,"field":"cvss","old":"5.9","new":"5.3"},{"seq":74938,"id":"CVE-2023-52323","ts":1789114883612,"field":"cvss","old":"5.3","new":"5.9"},{"seq":72831,"id":"CVE-2023-52323","ts":1789110057417,"field":"cvss","old":"5.9","new":"5.3"},{"seq":71773,"id":"CVE-2023-52323","ts":1789107347857,"field":"cvss","old":"5.3","new":"5.9"},{"seq":70715,"id":"CVE-2023-52323","ts":1789105706304,"field":"cvss","old":"5.9","new":"5.3"},{"seq":69657,"id":"CVE-2023-52323","ts":1789103501201,"field":"cvss","old":"5.3","new":"5.9"},{"seq":68599,"id":"CVE-2023-52323","ts":1789101349446,"field":"cvss","old":"5.9","new":"5.3"},{"seq":67541,"id":"CVE-2023-52323","ts":1789099631932,"field":"cvss","old":"5.3","new":"5.9"},{"seq":66510,"id":"CVE-2023-52323","ts":1789096959581,"field":"cvss","old":"5.9","new":"5.3"},{"seq":65472,"id":"CVE-2023-52323","ts":1789095708757,"field":"cvss","old":"5.3","new":"5.9"},{"seq":64447,"id":"CVE-2023-52323","ts":1789092615343,"field":"cvss","old":"5.9","new":"5.3"},{"seq":63422,"id":"CVE-2023-52323","ts":1789089045006,"field":"cvss","old":"5.3","new":"5.9"},{"seq":62397,"id":"CVE-2023-52323","ts":1789088232974,"field":"cvss","old":"5.9","new":"5.3"},{"seq":61372,"id":"CVE-2023-52323","ts":1789084633712,"field":"cvss","old":"5.3","new":"5.9"},{"seq":60347,"id":"CVE-2023-52323","ts":1789083902885,"field":"cvss","old":"5.9","new":"5.3"},{"seq":59322,"id":"CVE-2023-52323","ts":1789080785940,"field":"cvss","old":"5.3","new":"5.9"},{"seq":58297,"id":"CVE-2023-52323","ts":1789079576853,"field":"cvss","old":"5.9","new":"5.3"},{"seq":57272,"id":"CVE-2023-52323","ts":1789076962963,"field":"cvss","old":"5.3","new":"5.9"},{"seq":56250,"id":"CVE-2023-52323","ts":1789075193034,"field":"cvss","old":"5.9","new":"5.3"},{"seq":55202,"id":"CVE-2023-52323","ts":1789073111210,"field":"cvss","old":"5.3","new":"5.9"},{"seq":54186,"id":"CVE-2023-52323","ts":1789070929987,"field":"cvss","old":"5.9","new":"5.3"},{"seq":53161,"id":"CVE-2023-52323","ts":1789069221915,"field":"cvss","old":"5.3","new":"5.9"}]}