Ubuntu 23.10: 7894-3 high: python-requests security vulnerability

ubuntu

December 6, 2023

Several security issues were fixed in python-cryptography.

Summary

Several security issues were fixed in python-cryptography.

Software Description:

- python-cryptography: Cryptography Python library

Details:

It was discovered that the python-cryptography Cipher.update_into function

would incorrectly accept objects with immutable buffers. This would result

in corrupted output, contrary to expectations. This issue only affected

Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 23.04. (CVE-2023-23931)

It was dicovered that python-cryptography incorrectly handled loading

certain PKCS7 certificates. A remote attacker could possibly use this

issue to cause python-cryptography to crash, resulting in a denial of

service. This issue only affected Ubuntu 22.04 LTS, Ubuntu 23.04, and

Ubuntu 23.10. (CVE-2023-49083)

Topics Covered

security advisory update denial service remote attack ubuntu python-cryptography

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 23.10:
   python3-cryptography            38.0.4-4ubuntu0.23.10.1

Ubuntu 23.04:
   python3-cryptography            38.0.4-2ubuntu0.1

Ubuntu 22.04 LTS:
   python3-cryptography            3.4.8-1ubuntu2.1

Ubuntu 20.04 LTS:
   python-cryptography             2.8-3ubuntu0.2
   python3-cryptography            2.8-3ubuntu0.2

In general, a standard system update will make all the necessary changes.