Listen to this Post
The pkcs7_decrypt_der, pkcs7_decrypt_pem, and `pkcs7_decrypt_smime` functions in the `pyca/cryptography` library (versions 44.0.0 through 49.9.9) exposed a Bleichenbacher oracle through distinguishable error messages and timing side-channels. When decrypting a PKCS7 `EnvelopedData` structure, the library performed RSA PKCS1 v1.5 decryption of the encryptedKey, then built an AES cipher from the result, and finally performed AES-CBC decryption with PKCS7 unpadding. Each stage produced a distinct failure outcome:
– Invalid RSA padding → `Decryption failed`
– Valid padding, bad key length → Invalid key size (N) for AES., disclosing the exact length `N`
– Correct length, wrong key → `Invalid padding bytes.`
– The real key → plaintext
These distinguishable error channels, combined with timing differences, allowed an attacker to mount an adaptive chosen-ciphertext attack. By submitting crafted `EnvelopedData` messages to a service that automatically decrypts them and reflects the outcome (e.g., an S/MIME gateway or mail filter), the attacker could iteratively recover the content-encryption key. The first error case (invalid RSA padding) was only reachable when the underlying OpenSSL library lacked implicit rejection—specifically OpenSSL 3.0 and 3.1, LibreSSL, and BoringSSL. On OpenSSL 3.2+ (used in the official wheels), invalid padding instead returned a synthetic plaintext of pseudorandom length, closing that particular channel.
The vulnerability was introduced in version 44.0.0 and fixed in version 50.0.0. The fix, implemented per RFC 3218, resolves the content-encryption algorithm before using the private key, so the expected key length is known in advance. If RSA decryption fails or returns a key of the wrong length, a random key of the expected length is substituted, and decryption continues down an identical path—ensuring all failures report identically and perform the same work. Notably, this fix does not address the underlying CBC padding oracle inherent to PKCS7 `EnvelopedData` (which lacks authentication), as tampering with `encryptedContent` alone can recover plaintext at roughly 256 queries per byte on every backend—a property of the standard itself.
DailyCVE Form:
Platform: pyca/cryptography
Version: 44.0.0 – 49.9.9
Vulnerability: Bleichenbacher oracle via errors/timing
Severity: High (CVSS 8.2)
date: 2026-07-31
Prediction: Patch in v50.0.0 (2026-07-31)
What Undercode Say
Check your installed version:
pip show cryptography | grep Version
Upgrade to the patched version immediately:
pip install --upgrade cryptography>=50.0.0
Verify the fix by inspecting the error behavior (this script demonstrates the distinguishable failure modes present in vulnerable versions):
from cryptography.hazmat.primitives.serialization import pkcs7
from cryptography.hazmat.primitives import hashes, serialization
from cryptography.hazmat.primitives.asymmetric import rsa, padding
from cryptography.hazmat.backends import default_backend
import os
Generate a test RSA private key (for demonstration only)
private_key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
Craft a malformed EnvelopedData (invalid RSA padding) – this would trigger "Decryption failed"
In a vulnerable version, each error type is distinguishable.
In patched version (>=50.0.0), all errors are identical.
try:
pkcs7.decrypt_der(b"invalid_data", private_key)
except Exception as e:
print(f"Error: {e}")
Monitor for unexpected decryption errors in logs that might indicate an attempted exploit:
grep -i "decryption failed|invalid key size|invalid padding bytes" /var/log/your-app.log
Exploit
An attacker with network access can send a high volume of crafted `EnvelopedData` messages to a vulnerable service that automatically decrypts them (e.g., an S/MIME gateway). By observing the distinct error messages or measuring response timing, the attacker can iteratively refine guesses for the RSA-decrypted content-encryption key, eventually recovering it without needing the private key. This is a classic Bleichenbacher oracle attack, feasible within a practical number of queries (typically a few thousand) given the oracle’s precision.
Protection
- Immediate: Upgrade `cryptography` to version 50.0.0 or later.
- If upgrade is not possible:
- Ensure the underlying OpenSSL is 3.2 or newer (which provides implicit rejection for invalid RSA padding, closing one error channel).
- Avoid exposing any service that automatically decrypts untrusted `EnvelopedData` and reflects the outcome.
- Implement generic error handling that returns identical responses for all decryption failures.
- Long-term: Recognize that PKCS7 `EnvelopedData` does not provide authenticity; consider using authenticated encryption (e.g., CMS with authenticated modes) or apply additional integrity checks outside the library.
Impact
Successful exploitation allows an attacker to recover the content-encryption key used in an `EnvelopedData` message. This compromises the confidentiality of the encrypted content (e.g., emails, documents, or any data protected by the victim’s certificate). The attack requires the victim service to decrypt attacker-supplied messages and reveal oracle feedback—common in mail filters, automated document processors, or API gateways that handle S/MIME. With the key, the attacker can decrypt past and future messages encrypted with the same key, leading to data breach, privacy violation, and potential further lateral movement if the key is reused. The CVSS score of 8.2 (High) reflects the network attack vector, high attack complexity (due to adaptive queries), and high confidentiality impact.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
