The pyca cryptography package versions >=44.0.0 <50.0.0 contain a vulnerability where the decryption functions for PKCS#7 EnvelopedData leak information about the decrypted RSA encryptedKey via timing and error message discrepancies. Specifically, the functions pkcs7_decrypt_der, pkcs7_decrypt_pem, and pkcs7_decrypt_smime report different outcomes for invalid RSA padding, valid padding with incorrect key length, correct length with wrong key, and the real key. This creates a Bleichenbacher oracle that can be exploited if a service automatically decrypts untrusted EnvelopedData matching the victim certificate and responds adaptively at high volume, such as an S/MIME gateway or mail filter. The issue arises when the underlying cryptographic library (OpenSSL 3.0/3.1, LibreSSL, BoringSSL) does not implicitly reject certain padding cases. The vulnerability is resolved in version 50.0.0 of the cryptography package.

An attacker who can supply EnvelopedData to a vulnerable service that decrypts and reflects the result can use the timing and error message differences to perform a Bleichenbacher attack. This can lead to disclosure of the content-encryption key, potentially allowing decryption of protected data. The vulnerability requires a high-volume adaptive response service and is limited to environments using affected versions of the cryptography package with certain underlying TLS libraries. No known exploits in the wild have been reported.

Upgrade the pyca cryptography package to version 50.0.0 or later, where this vulnerability is fixed. If upgrading is not immediately possible, avoid decrypting untrusted EnvelopedData or ensure that the service does not leak decryption outcome details through timing or error messages. Since this is not a cloud service, remediation depends on applying the official fix.