pyca cryptography CVE-2026-69247

The vulnerability resides in the Rust-backed PKCS#7 decryption implementation (src/rust/src/pkcs7.rs) of pyca/cryptography, introduced in version 44.0.0. PKCS#7 EnvelopedData uses RSA PKCS#1 v1.5 to wrap the content-encryption key, which is then used with AES-CBC to decrypt the message body. The four-stage pipeline - RSA decrypt → key length check → AES-CBC decrypt → PKCS#7 unpad - each failed with a distinct observable outcome: (1) invalid RSA padding yielded 'Decryption failed', (2) valid padding with wrong key length leaked the recovered length as 'Invalid key size (N) for AES.', (3) correct length with wrong key yielded 'Invalid padding bytes.', and (4) the real key succeeded. CWE-208 (Observable Discrepancy) applies directly: the length disclosure in case 2 and timing differences across all four cases form a multi-channel oracle. Case 1 is reachable only when the linked native library lacks implicit rejection - specifically OpenSSL 3.0 and 3.1, LibreSSL, and BoringSSL. OpenSSL 3.2+, used in pyca's own distributed wheels, returns a pseudorandom synthetic plaintext for invalid padding, suppressing case 1. The fix, per RFC 3218, resolves the content-encryption algorithm (and thus expected key size) before invoking RSA, then substitutes a cryptographically random key of the expected length on any failure, making all error paths computationally indistinguishable. CPE: cpe:2.3:a:pyca:cryptography:*:*:*:*:*:*:*:* (versions 44.0.0-49.x).