Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-xyku-dd6j-u3ex
Vulnerability ID VCID-xyku-dd6j-u3ex
Aliases CVE-2023-52323
GHSA-j225-cvw7-qrx7
PYSEC-2024-3
Summary PyCryptodome and pycryptodomex before 3.19.1 allow side-channel leakage for OAEP decryption, exploitable for a Manger attack.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-203 Observable Discrepancy
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 5.9 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-52323.json
epss 0.00074 https://api.first.org/data/v1/epss?cve=CVE-2023-52323
epss 0.00074 https://api.first.org/data/v1/epss?cve=CVE-2023-52323
epss 0.00074 https://api.first.org/data/v1/epss?cve=CVE-2023-52323
epss 0.00074 https://api.first.org/data/v1/epss?cve=CVE-2023-52323
epss 0.00074 https://api.first.org/data/v1/epss?cve=CVE-2023-52323
epss 0.00074 https://api.first.org/data/v1/epss?cve=CVE-2023-52323
epss 0.00074 https://api.first.org/data/v1/epss?cve=CVE-2023-52323
epss 0.00074 https://api.first.org/data/v1/epss?cve=CVE-2023-52323
epss 0.00074 https://api.first.org/data/v1/epss?cve=CVE-2023-52323
epss 0.00074 https://api.first.org/data/v1/epss?cve=CVE-2023-52323
epss 0.00074 https://api.first.org/data/v1/epss?cve=CVE-2023-52323
epss 0.00074 https://api.first.org/data/v1/epss?cve=CVE-2023-52323
epss 0.00074 https://api.first.org/data/v1/epss?cve=CVE-2023-52323
epss 0.00074 https://api.first.org/data/v1/epss?cve=CVE-2023-52323
cvssv3.1 5.9 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-j225-cvw7-qrx7
cvssv3.1 5.3 https://github.com/Legrandin/pycryptodome
cvssv4 7.1 https://github.com/Legrandin/pycryptodome
generic_textual HIGH https://github.com/Legrandin/pycryptodome
cvssv3.1 5.3 https://github.com/Legrandin/pycryptodome/blob/master/Changelog.rst
cvssv3.1 5.9 https://github.com/Legrandin/pycryptodome/blob/master/Changelog.rst
cvssv4 7.1 https://github.com/Legrandin/pycryptodome/blob/master/Changelog.rst
generic_textual HIGH https://github.com/Legrandin/pycryptodome/blob/master/Changelog.rst
ssvc Track https://github.com/Legrandin/pycryptodome/blob/master/Changelog.rst
cvssv3.1 5.3 https://github.com/Legrandin/pycryptodome/commit/0deea1bfe1489e8c80d2053bbb06a1aa0b181ebd
cvssv4 7.1 https://github.com/Legrandin/pycryptodome/commit/0deea1bfe1489e8c80d2053bbb06a1aa0b181ebd
generic_textual HIGH https://github.com/Legrandin/pycryptodome/commit/0deea1bfe1489e8c80d2053bbb06a1aa0b181ebd
cvssv3.1 5.3 https://github.com/pypa/advisory-database/tree/main/vulns/pycryptodomex/PYSEC-2024-3.yaml
cvssv4 7.1 https://github.com/pypa/advisory-database/tree/main/vulns/pycryptodomex/PYSEC-2024-3.yaml
generic_textual HIGH https://github.com/pypa/advisory-database/tree/main/vulns/pycryptodomex/PYSEC-2024-3.yaml
cvssv3.1 5.3 https://nvd.nist.gov/vuln/detail/CVE-2023-52323
cvssv4 7.1 https://nvd.nist.gov/vuln/detail/CVE-2023-52323
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2023-52323
cvssv3.1 5.3 https://pypi.org/project/pycryptodomex/#history
cvssv3.1 5.9 https://pypi.org/project/pycryptodomex/#history
cvssv4 7.1 https://pypi.org/project/pycryptodomex/#history
generic_textual HIGH https://pypi.org/project/pycryptodomex/#history
ssvc Track https://pypi.org/project/pycryptodomex/#history
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-52323.json
https://api.first.org/data/v1/epss?cve=CVE-2023-52323
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-52323
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/Legrandin/pycryptodome
https://github.com/Legrandin/pycryptodome/blob/master/Changelog.rst
https://github.com/Legrandin/pycryptodome/commit/0deea1bfe1489e8c80d2053bbb06a1aa0b181ebd
https://github.com/pypa/advisory-database/tree/main/vulns/pycryptodomex/PYSEC-2024-3.yaml
https://nvd.nist.gov/vuln/detail/CVE-2023-52323
https://pypi.org/project/pycryptodomex/#history
1060059 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1060059
2257028 https://bugzilla.redhat.com/show_bug.cgi?id=2257028
GHSA-j225-cvw7-qrx7 https://github.com/advisories/GHSA-j225-cvw7-qrx7
RHSA-2024:1057 https://access.redhat.com/errata/RHSA-2024:1057
RHSA-2024:1155 https://access.redhat.com/errata/RHSA-2024:1155
RHSA-2024:2132 https://access.redhat.com/errata/RHSA-2024:2132
RHSA-2024:2952 https://access.redhat.com/errata/RHSA-2024:2952
RHSA-2024:2968 https://access.redhat.com/errata/RHSA-2024:2968
USN-6595-1 https://usn.ubuntu.com/6595-1/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-52323.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/Legrandin/pycryptodome
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N Found at https://github.com/Legrandin/pycryptodome
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/Legrandin/pycryptodome/blob/master/Changelog.rst
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/Legrandin/pycryptodome/blob/master/Changelog.rst
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N Found at https://github.com/Legrandin/pycryptodome/blob/master/Changelog.rst
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-05-08T17:36:55Z/ Found at https://github.com/Legrandin/pycryptodome/blob/master/Changelog.rst
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/Legrandin/pycryptodome/commit/0deea1bfe1489e8c80d2053bbb06a1aa0b181ebd
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N Found at https://github.com/Legrandin/pycryptodome/commit/0deea1bfe1489e8c80d2053bbb06a1aa0b181ebd
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/pypa/advisory-database/tree/main/vulns/pycryptodomex/PYSEC-2024-3.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N Found at https://github.com/pypa/advisory-database/tree/main/vulns/pycryptodomex/PYSEC-2024-3.yaml
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2023-52323
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N Found at https://nvd.nist.gov/vuln/detail/CVE-2023-52323
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://pypi.org/project/pycryptodomex/#history
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://pypi.org/project/pycryptodomex/#history
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N Found at https://pypi.org/project/pycryptodomex/#history
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-05-08T17:36:55Z/ Found at https://pypi.org/project/pycryptodomex/#history
Exploit Prediction Scoring System (EPSS)
Percentile 0.22531
EPSS Score 0.00074
Published At April 2, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T12:49:10.968523+00:00 Pypa Importer Import https://github.com/pypa/advisory-database/blob/main/vulns/pycryptodomex/PYSEC-2024-3.yaml 38.0.0