The pyca cryptography package versions >=44.0.0 and <50.0.0 contain a vulnerability where the pkcs7_decrypt_der, pkcs7_decrypt_pem, and pkcs7_decrypt_smime functions reveal the outcome of decrypting a RecipientInfo's encryptedKey in distinguishable ways, including timing differences. This allows an attacker to perform a Bleichenbacher oracle attack on the content-encryption key by analyzing the decryption responses. The vulnerability arises because invalid RSA padding, valid padding with incorrect key length, correct length with wrong key, and the real key each produce different failure or success signals. This is particularly exploitable when the underlying cryptographic library lacks implicit rejection of invalid padding, such as OpenSSL 3.0/3.1, LibreSSL, and BoringSSL. Exploitation requires a service that auto-decrypts untrusted EnvelopedData and responds adaptively, such as an S/MIME gateway or mail filter. The vulnerability is resolved in pyca cryptography version 50.0.0.

An attacker can exploit this vulnerability to perform a Bleichenbacher oracle attack against the content-encryption key used in RSA PKCS#1 v1.5 decryption within the affected pyca cryptography versions. This could lead to the recovery of sensitive cryptographic keys if the application decrypts attacker-controlled EnvelopedData and reveals decryption outcomes. The impact is significant in environments where such auto-decryption services exist and respond adaptively, potentially compromising confidentiality of encrypted communications.

This vulnerability is fixed in pyca cryptography version 50.0.0. Users should upgrade to version 50.0.0 or later to remediate this issue. No official patch or temporary fix is indicated other than upgrading. Since this is not a cloud service, remediation depends on user action to update the package. Patch status is confirmed by the vendor advisory stating the fix is in version 50.0.0.