openSUSE Patches Two Python RSA Vulnerabilities on Tumbleweed
openSUSE has published advisory openSUSE-SU-2026:12041-1, rated moderate, covering two cryptography flaws fixed in the python-rsa library on openSUSE Tumbleweed GA media. The update ships python313-rsa 4.9.1-1.4 and python314-rsa 4.9.1-1.4, resolving CVE-2020-13757 and CVE-2020-25658. SUSE scores the first at 7.5 and the second at 5.9 under CVSS 3.1. Any Tumbleweed host running the earlier python-rsa packages for Python 3.13 or 3.14 is in scope.
The advisory does not publish exploitation details for either issue, and no proof-of-concept or attack chain is described. SUSE scores CVE-2020-13757 at 7.5 and CVE-2020-25658 at 5.9 under CVSS 3.1, but the advisory does not explain how the vulnerabilities work or what conditions enable exploitation. The source provides no mechanism description for either CVE.
Both vulnerabilities affect the python-rsa library used on openSUSE Tumbleweed systems. Current exploitation likelihood is low: FIRST EPSS places CVE-2020-13757 at a 1.4% probability of exploitation in the next 30 days and CVE-2020-25658 at 1.7%. Neither CVE is reported as under active attack, and the fixed packages are already carried on Tumbleweed GA media, leaving residual risk with hosts not yet refreshed. The CVSS scores indicate moderate to high severity, with the higher-scored CVE-2020-13757 presenting the greater risk.
Attack Surface
Endpoint OS, Server OS, Supply Chain (Third-party vendors)
Tactics
Credential Access, Collection
Techniques
- T1040 – Network Sniffing
- T1557 – Adversary-in-the-Middle
SuperPRO's Threat Countermeasures Procedures
- Install the fixed packages from openSUSE-SU-2026:12041-1 on Tumbleweed systems: python313-rsa 4.9.1-1.4 and python314-rsa 4.9.1-1.4, using zypper refresh followed by zypper update python313-rsa python314-rsa.
- Inventory hosts with rpm -q python313-rsa python314-rsa and treat any build older than 4.9.1-1.4 as still carrying CVE-2020-13757 and CVE-2020-25658.
- Verify the installed package version with rpm -qa | grep python3 to confirm that both python313-rsa and python314-rsa are at 4.9.1-1.4 or later after the update completes.
- Review the SUSE CVE pages for CVE-2020-13757 and CVE-2020-25658 to confirm the scope of affected configurations and any additional guidance published after the advisory.
- Monitor SUSE security announcements for any follow-up advisories related to python-rsa or the two CVEs, as additional information may be published after initial release.
- Add CVE-2020-13757 and CVE-2020-25658 to the vulnerability scanner allow-list for verification scanning after deployment, and confirm closure against the SUSE CVE pages for both identifiers.
