Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 510
Alerts This Week
Warning Icon 1 510

SUSE: 2018:3553-1 Moderate: Key Leakage Risk in Python-Cryptography

suse
Calendar Grey October 29, 2018
Dist Suse Esm H88
A notable security concern in python-cryptography has been resolved. Implement suggested updates on affected SUSE systems.
An update that fixes one vulnerability is now available

Summary

This update for python-cryptography fixes the following issues: - CVE-2018-10903: The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries could have caused key leakage (bsc#1101820) Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud Crowbar 8: zypper in -t patch SUSE-OpenStack-Cloud-Crowbar-8-2018-2517=1 - SUSE OpenStack Cloud 8:

Topics%20covered

Topics Covered

security advisory moderate severity suse openstack python cryptography key leakage

References

#1101820

Cross- CVE-2018-10903

Affected Products:

SUSE OpenStack Cloud Crowbar 8

SUSE OpenStack Cloud 8

HPE Helion Openstack 8

https://www.suse.com/security/cve/CVE-2018-10903.html

https://bugzilla.suse.com/1101820

Announcement ID: SUSE-SU-2018:3553-1
Rating: moderate

Topics%20covered

Topics Covered

security advisory moderate severity suse openstack python cryptography key leakage

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.