Explore top 10 tips to secure your open-source projects now. Read More
×
Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Is application sandboxing truly safe?
Loading...
Explore Latest Linux Security advisories
We found -3 articles for you...
100
security advisorymoderatebuffer overflowSUSE: 2023:4922-1 moderate: python-cryptography buffer overflow
* bsc#1217592 Cross-References: * CVE-2023-49083 . # Security update for python-cryptography Announcement ID: SUSE-SU-2023:4921-1 Rating: moderate References: * bsc#1217592 Cross-References: * CVE-2023-49083 CVSS scores: * CVE-2023-49083 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2023-49083 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: * SUSE Linux Enterprise Micro 5.1 * SUSE Linux Enterprise Micro 5.2 * SUSE Linux Enterprise Micro for Rancher 5.2 An update that solves one vulnerability can now be installed. ## Description: This update for python-cryptography fixes the following issues: * CVE-2023-49083: Fixed a NULL pointer dereference when loading certificates from a PKCS#7 bundle (bsc#1217592). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise Micro 5.1 zypper in -t patch SUSE-SUSE-MicroOS-5.1-2023-4921=1 * SUSE Linux Enterprise Micro 5.2 zypper in -t patch SUSE-SUSE-MicroOS-5.2-2023-4921=1 * SUSE Linux Enterprise Micro for Rancher 5.2 zypper in -t patch SUSE-SUSE-MicroOS-5.2-2023-4921=1 ## Package List: * SUSE Linux Enterprise Micro 5.1 (aarch64 s390x x86_64) * python-cryptography-debugsource-3.3.2-150200.22.1 * python-cryptography-debuginfo-3.3.2-150200.22.1 * python3-cryptography-debuginfo-3.3.2-150200.22.1 * python3-cryptography-3.3.2-150200.22.1 * SUSE Linux Enterprise Micro 5.2 (aarch64 s390x x86_64) * python-cryptography-debugsource-3.3.2-150200.22.1 * python-cryptography-debuginfo-3.3.2-150200.22.1 * python3-cryptography-debuginfo-3.3.2-150200.22.1 * python3-cryptography-3.3.2-150200.22.1 * SUSE Linux Enterprise Micro for Rancher 5.2 (aarch64 s390x x86_64) * python-cryptography-debugsource-3.3.2-150200.22.1 *python-cryptography-debuginfo-3.3.2-150200.22.1 * python3-cryptography-debuginfo-3.3.2-150200.22.1 * python3-cryptography-3.3.2-150200.22.1 ## References: * https://www.suse.com/security/cve/CVE-2023-49083.html * https://bugzilla.suse.com/show_bug.cgi?id=1217592 . SUSE has issued a security notice regarding the python-cryptography flaw CVE-2023-49083. It is crucial for users to perform updates without delay.. SUSE Linux Enterprise Micro, Python Cryptography Update, Security Patch. . LinuxSecurity.com Team
Dec 20, 2023
SuSE
203
security advisorysecurity fixmoderate severityMageia 8: 2023-0071 Moderate: Python-Cryptography Buffer Issue
Cipher.update_into would accept Python objects which implement the buffer protocol, but provide only immutable buffers. This would allow immutable objects (such as 'bytes') to be mutated, thus violating fundamental rules of Python and resulting in corrupted output. This now correctly raises an exception. (CVE-2023-23931) . MGASA-2023-0071 - Updated python-cryptography packages fix security vulnerability Publication date: 27 Feb 2023 URL: https://advisories.mageia.org/MGASA-2023-0071.html Type: security Affected Mageia releases: 8 CVE: CVE-2023-23931 Cipher.update_into would accept Python objects which implement the buffer protocol, but provide only immutable buffers. This would allow immutable objects (such as 'bytes') to be mutated, thus violating fundamental rules of Python and resulting in corrupted output. This now correctly raises an exception. (CVE-2023-23931) References: - https://bugs.mageia.org/show_bug.cgi?id=31584 - https://lists.debian.org/debian-lts-announce/2023/02/msg00027.html - https://www.cve.org/CVERecord?id=CVE-2023-23931 SRPMS: - 8/core/python-cryptography-3.3.1-1.2.mga8 . The latest python-cryptography update tackles a significant security vulnerability, reinforcing the integrity of data, launched on March 5.. python Cryptography Security, Mageia Update, Buffer Protocol Issue, Security Patch. . LinuxSecurity.com Team
Feb 27, 2023
Mageia
100
security advisorybuffer overflowimportantSUSE: 2021:0594-1 Important: python-cryptography Buffer Overflow
An update that fixes one vulnerability is now available. . SUSE Security Update: Security update for python-cryptography ______________________________________________________________________________ Announcement ID: SUSE-SU-2021:0594-1 Rating: important References: #1182066 Cross-References: CVE-2020-36242 CVSS scores: CVE-2020-36242 (NVD) : 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H CVE-2020-36242 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: SUSE Linux Enterprise Module for Python2 15-SP2 SUSE Linux Enterprise Module for Basesystem 15-SP2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-cryptography fixes the following issues: - CVE-2020-36242: Using the Fernet class to symmetrically encrypt multi gigabyte values could result in an integer overflow and buffer overflow (bsc#1182066). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Module for Python2 15-SP2: zypper in -t patch SUSE-SLE-Module-Python2-15-SP2-2021-594=1 - SUSE Linux Enterprise Module for Basesystem 15-SP2: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP2-2021-594=1 Package List: - SUSE Linux Enterprise Module for Python2 15-SP2 (aarch64 ppc64le s390x x86_64): python-cryptography-debuginfo-2.8-3.6.1 python-cryptography-debugsource-2.8-3.6.1 python2-cryptography-2.8-3.6.1 python2-cryptography-debuginfo-2.8-3.6.1 - SUSE Linux Enterprise Module for Basesystem 15-SP2 (aarch64 ppc64le s390x x86_64): python-cryptography-debuginfo-2.8-3.6.1 python-cryptography-debugsource-2.8-3.6.1 python3-cryptography-2.8-3.6.1 python3-cryptography-debuginfo-2.8-3.6.1 References: https://www.suse.com/security/cve/CVE-2020-36242.html https://bugzilla.suse.com/1182066 . A new release for python-cryptography has been issued to mitigate a buffer overflow vulnerability. Installation steps for SUSE users are detailed as follows.. SUSE Security Update, Python Cryptography Fix, Software Patch Instructions. . LinuxSecurity.com Team
Feb 25, 2021
SuSE
98
security advisorysecurity updatemoderate riskRed Hat OpenStack Platform 13.0 RHSA-2018:3600-01 Moderate GCM Forgery
An update for python-cryptography is now available for Red Hat OpenStack Platform 13.0 (Queens). Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: python-cryptography security update Advisory ID: RHSA-2018:3600-01 Product: Red Hat Enterprise Linux OpenStack Platform Advisory URL: https://access.redhat.com/errata/RHSA-2018:3600 Issue date: 2018-11-13 CVE Names: CVE-2018-10903 ==================================================================== 1. Summary: An update for python-cryptography is now available for Red Hat OpenStack Platform 13.0 (Queens). Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat OpenStack Platform 13.0 - ppc64le, x86_64 3. Description: The python-cryptography packages contain a Python Cryptographic Authority's (PyCA's) cryptography library, which provides cryptographic primitives and recipes to Python developers. Security Fix(es): * python-cryptography: GCM tag forgery via truncated tag in finalize_with_tag API (CVE-2018-10903) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1602931 - CVE-2018-10903 python-cryptography: GCM tag forgery via truncated tag infinalize_with_tag API 6. Package List: Red Hat OpenStack Platform 13.0: Source: python-cryptography-2.1.4-3.el7ost.src.rpm ppc64le: python-cryptography-debuginfo-2.1.4-3.el7ost.ppc64le.rpm python2-cryptography-2.1.4-3.el7ost.ppc64le.rpm x86_64: python-cryptography-debuginfo-2.1.4-3.el7ost.x86_64.rpm python2-cryptography-2.1.4-3.el7ost.x86_64.rpm Red Hat OpenStack Platform 13.0: Source: python-cryptography-2.1.4-3.el7ost.src.rpm ppc64le: python-cryptography-debuginfo-2.1.4-3.el7ost.ppc64le.rpm python2-cryptography-2.1.4-3.el7ost.ppc64le.rpm x86_64: python-cryptography-debuginfo-2.1.4-3.el7ost.x86_64.rpm python2-cryptography-2.1.4-3.el7ost.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2018-10903 https://access.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2018 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBW+tM7NzjgjWX9erEAQjf6w/+JIL6y/CCTrgy8FnLswb6XmuSlrBsC90d wmYPV2p3BDOtSjUMyVOSy+75eZelZwtONnfo51zJWmBS9fhLN8aNGm6kU2scYv/o ldREwLYYlZ6zo6JfRzOrVxcKEP2CwHvMtGFfWWUzLCIW+h1ANoYh1Q6gII22Txcf ouE1Gl11bIORqR2RJHQg5XUL6DXa0l0HeUDfkFDIDt+VNZP4vd7dpElZXBIWLg3Q lFeRIdzWcGgFzje+id9P2JHOWS4wslFKHHoerOgyroVL1nkPCMwf50Jliis3B3K6 EcpLBU93haFee6j0T0YipmIRtfKVkYq6c4/RHg7UDykzgfiOOlv8vIo9dj2befF1 0jJwfhREzLTrDO0Aiq/Syq6ydqYsxlhnbVz8QT/lFjvP+4xmBnM00imfzXYKu2Fj XBJ2EmYP34f4y/AxuIEtoeG68jz2Y3F2x1gxAzLGlalQTQskj+pYKesgNCIrpToi FJ+DXRhjnsLQIA6QT/T3nugchIWqcQ+5RvOjy7AjUkltGmgz8iFogcNbN65mj0Lh ii3SlEedsP+d7faNJRbyb0XpiQNA5e01fKw77nfhSQynOiPgmUTtYx/tmg+qufBs QXY5ZgEVaQPxnX4MxpjiMPXseoINE1uUVqVP3zNAdZSrgDLmUhV2nRvZ291eaNzm O0ZyUrwFRQI=Rpuv -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Nov 13, 2018
Red Hat
100
security advisorymoderate severitysuse openstackSUSE: 2018:3553-1 Moderate: Key Leakage Risk in Python-Cryptography
An update that fixes one vulnerability is now available. . SUSE Security Update: Security update for python-cryptography ______________________________________________________________________________ Announcement ID: SUSE-SU-2018:3553-1 Rating: moderate References: #1101820 Cross-References: CVE-2018-10903 Affected Products: SUSE OpenStack Cloud Crowbar 8 SUSE OpenStack Cloud 8 HPE Helion Openstack 8 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-cryptography fixes the following issues: - CVE-2018-10903: The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries could have caused key leakage (bsc#1101820) Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud Crowbar 8: zypper in -t patch SUSE-OpenStack-Cloud-Crowbar-8-2018-2517=1 - SUSE OpenStack Cloud 8: zypper in -t patch SUSE-OpenStack-Cloud-8-2018-2517=1 - HPE Helion Openstack 8: zypper in -t patch HPE-Helion-OpenStack-8-2018-2517=1 Package List: - SUSE OpenStack Cloud Crowbar 8 (x86_64): python-cryptography-2.0.3-3.3.1 python-cryptography-debuginfo-2.0.3-3.3.1 python-cryptography-debugsource-2.0.3-3.3.1 - SUSE OpenStack Cloud 8 (x86_64): python-cryptography-2.0.3-3.3.1 python-cryptography-debuginfo-2.0.3-3.3.1 python-cryptography-debugsource-2.0.3-3.3.1 - HPE Helion Openstack 8(x86_64): python-cryptography-2.0.3-3.3.1 python-cryptography-debuginfo-2.0.3-3.3.1 python-cryptography-debugsource-2.0.3-3.3.1 References: https://www.suse.com/security/cve/CVE-2018-10903.html https://bugzilla.suse.com/1101820 _______________________________________________ sle-security-updates mailing list
Oct 29, 2018
SuSE
89
security advisorysecurity updatesecurity issueFedora: 2018-06c24068c6 Moderate: Python-Cryptography Tag Forgery Issue
# New upstream release 2.3 Fixes possible tag truncation security bug in AEAD API, see RHBZ#1602752 ## 2.3 - 2018-07-18 * SECURITY ISSUE: finalize_with_tag() allowed tag truncation by default which can allow tag forgery in some cases. The method now enforces the min_tag_length provided to the GCM constructor. * Added support for Python 3.7. * Added extract_timestamp(). --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2018-06c24068c6 2018-07-31 17:09:33.504512 --------------------------------------------------------------------------------Name : python-cryptography Product : Fedora 27 Version : 2.3 Release : 1.fc27 URL : https://cryptography.io/en/latest/ Summary : PyCA's cryptography library Description : cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. --------------------------------------------------------------------------------Update Information: # New upstream release 2.3 Fixes possible tag truncation security bug in AEAD API, see RHBZ#1602752 ## 2.3 - 2018-07-18 * SECURITY ISSUE: finalize_with_tag() allowed tag truncation by default which can allow tag forgery in some cases. The method now enforces the min_tag_length provided to the GCM constructor. * Added support for Python 3.7. * Added extract_timestamp() to get the authenticated timestamp of a Fernet token. * Support for Python 2.7.x without hmac.compare_digest has been deprecated. We will require Python 2.7.7 or higher (or 2.7.6 on Ubuntu) in the next cryptography release. * Fixed multiple issues preventing cryptography from compiling against LibreSSL 2.7.x. * Added get_revoked_certificate_by_serial_number for quick serial number searches in CRLs. * The RelativeDistinguishedName class now preserves the order of attributes. Duplicate attributes now raise an error instead of silently discarding duplicates. * aes_key_unwrap() and aes_key_unwrap_with_padding()now raise InvalidUnwrap if the wrapped key is an invalid length, instead of ValueError. --------------------------------------------------------------------------------ChangeLog: * Wed Jul 18 2018 Christian Heimes - 2.3-1 - New upstream release 2.3 - Fix AEAD tag truncation bug, RHBZ#1602752 * Sun Feb 18 2018 Christian Heimes - 2.0.2-4 - Build requires gcc * Tue Oct 24 2017 Christian Heimes - 2.0.2-3 - Change Requires to openssl-libs --------------------------------------------------------------------------------References: [ 1 ] Bug #1602752 - Possible tag truncation security bug in AEAD API https://bugzilla.redhat.com/show_bug.cgi?id=1602752 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2018-06c24068c6' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list --
Jul 31, 2018
Fedora
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Is application sandboxing truly safe?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!