Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges×

Alerts This Week
Warning Icon 1 515
Alerts This Week
Warning Icon 1 515

Ubuntu: 3138-1 Critical: Python-Cryptography Key Generation Flaw

ubuntu
Calendar Grey November 28, 2016
Scroller Ubuntu
Critical alert regarding python-cryptography flaw impacting Ubuntu platforms—verify the integrity and precision of your key generation.
python-cryptography could generate incorrect keys.

Summary

python-cryptography could generate incorrect keys.

Software Description:

- python-cryptography: Cryptography Python library

Details:

Markus Döring discovered that python-cryptography incorrectly handled

certain HKDF lengths. This could result in python-cryptography returning an

empty string instead of the expected derived key.

Topics%20covered

Topics Covered

security advisory critical software update ubuntu flaw key generation python-cryptography

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 16.10:
  python-cryptography             1.5-2ubuntu0.1
  python3-cryptography            1.5-2ubuntu0.1

Ubuntu 16.04 LTS:
  python-cryptography             1.2.3-1ubuntu0.1
  python3-cryptography            1.2.3-1ubuntu0.1

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-3138-1

CVE-2016-9243

Severity
critical
Lowest
Low
Medium
High
Critical

November 28, 2016

Topics%20covered

Topics Covered

security advisory critical software update ubuntu flaw key generation python-cryptography

Package Information

https://launchpad.net/ubuntu/+source/python-cryptography/1.5-2ubuntu0.1
https://launchpad.net/ubuntu/+source/python-cryptography/1.2.3-1ubuntu0.1

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.