CVE-2025-46833: Python RSA Encryption Information Disclosure

CVE-2025-46833 Overview

CVE-2025-46833 affects Programs/P73_SimplePythonEncryption.py, a sample Python script in the ShashikantSingh09/python-progrrames GitHub repository that demonstrates RSA encryption. The script generated RSA keys with a 1024-bit key size, which is considered cryptographically weak. An attacker with sufficient compute resources can decrypt data protected by these keys through brute force or factoring attacks. The weakness is classified as [CWE-326] Inadequate Encryption Strength. The maintainer patched the issue in commit 6ce60b1 by increasing the RSA key size to 2048 bits.

Critical Impact
Data encrypted with the vulnerable 1024-bit RSA key generation can be decrypted by an attacker, breaking confidentiality for any application relying on the example code.

Affected Products

ShashikantSingh09/python-progrrames repository, file Programs/P73_SimplePythonEncryption.py
All commits prior to 6ce60b1
Any downstream code that reused the 1024-bit RSA key generation pattern from this example

Discovery Timeline

2025-05-08 - CVE-2025-46833 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-46833

Vulnerability Analysis

The script uses the PyCryptodome RSA.generate() function to create an asymmetric key pair. The original implementation requested a 1024-bit modulus, which no longer meets modern cryptographic strength requirements. NIST SP 800-57 has deprecated 1024-bit RSA since 2013, and current guidance requires at least 2048-bit RSA keys for confidentiality that must persist beyond the near term.

An attacker who captures ciphertext produced with a 1024-bit RSA key can attempt integer factorization of the public modulus. Academic and nation-state actors have demonstrated factorization of RSA-1024-class moduli, and cloud-scale compute lowers the cost further. Once the modulus is factored, the attacker recovers the private key and decrypts all traffic protected by that key pair.

Because this file is a public code sample, the primary risk is propagation: developers copying the example inherit the weak key size into production applications.

Root Cause

The root cause is a hardcoded weak key length passed to the RSA key generator. The example did not follow current cryptographic guidance for asymmetric key strength, resulting in Inadequate Encryption Strength [CWE-326].

Attack Vector

Exploitation is network-based and does not require authentication or user interaction. An attacker intercepts or obtains ciphertext generated by the vulnerable code, then performs offline factorization of the public modulus to recover the private key. No interaction with the target system is needed beyond obtaining the ciphertext and public key.

python

 randomGenerator = Random.new().read
 # Generating a private key and a public key
 # key stores both the keys
-key = RSA.generate(1024, randomGenerator) # 1024 is the size of the key in bits
+key = RSA.generate(2048, randomGenerator) # 2048 is the size of the key in bits
 print(key)                                # Prints private key
 print(key.publickey())                    # Prints public key

Source: GitHub commit 6ce60b1. The patch replaces the 1024-bit key parameter with 2048 bits.

Detection Methods for CVE-2025-46833

Indicators of Compromise

Presence of RSA.generate(1024, ...) or equivalent 1024-bit key generation calls in Python source code repositories
RSA public keys with a modulus length of 1024 bits stored in configuration files, key stores, or PEM/DER artifacts
Use of unpatched copies of Programs/P73_SimplePythonEncryption.py from commits prior to 6ce60b1

Detection Strategies

Run static analysis over source repositories to flag calls to RSA.generate, DSA.generate, or ECC.generate with key sizes below current guidance
Inventory certificates and public keys across systems and identify any with modulus length under 2048 bits for RSA or DSA, and under 256 bits for ECC
Use dependency and code-scanning tools such as GitHub code scanning, which originally surfaced this issue as a weak cryptographic key alert

Monitoring Recommendations

Track cryptographic key generation events in application logs where feasible and alert on non-compliant key sizes
Monitor code repositories for new commits that introduce weak RSA.generate or DSA.generate calls through pre-commit hooks or CI checks
Review TLS and application handshake telemetry for peers presenting 1024-bit RSA public keys

How to Mitigate CVE-2025-46833

Immediate Actions Required

Update to commit 6ce60b1 or later of the ShashikantSingh09/python-progrrames repository
Audit downstream projects that copied the example and replace all RSA.generate(1024, ...) calls with RSA.generate(2048, ...) or stronger
Rotate any RSA key pairs that were generated with 1024-bit modulus and re-encrypt data protected by them

Patch Information

The issue is patched in commit 6ce60b1 of the repository. Additional advisory context is available in the GitHub Security Advisory GHSA-5h26-2c6g-4ch4.

Workarounds

Increase the RSA or DSA key size to at least 2048 bits per the advisory guidance
For ECC keys, use a curve providing at least 256 bits of key strength, such as P-256 or Curve25519
Do not reuse existing 1024-bit key pairs after upgrading; generate fresh key material and revoke the weak keys

bash

# Configuration example: generate a compliant 2048-bit RSA key with OpenSSL
openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out private_key.pem
openssl rsa -in private_key.pem -pubout -out public_key.pem