Stay Secure with the Latest Linux Advisories

security advisorymoderateSUSE

SUSE: 2018:3392-1 Moderate: python-cryptography Key Forging Risk

An update that fixes one vulnerability is now available. . SUSE Security Update: Security update for python-cryptography ______________________________________________________________________________ Announcement ID: SUSE-SU-2018:3392-1 Rating: moderate References: #1101820 Cross-References: CVE-2018-10903 Affected Products: SUSE Linux Enterprise Module for Basesystem 15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-cryptography fixes the following issues: - CVE-2018-10903: The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries could have caused key leakage (bsc#1101820). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Module for Basesystem 15: zypper in -t patch SUSE-SLE-Module-Basesystem-15-2018-2430=1 Package List: - SUSE Linux Enterprise Module for Basesystem 15 (aarch64 ppc64le s390x x86_64): python-cryptography-debuginfo-2.1.4-4.3.1 python-cryptography-debugsource-2.1.4-4.3.1 python2-cryptography-2.1.4-4.3.1 python2-cryptography-debuginfo-2.1.4-4.3.1 python3-cryptography-2.1.4-4.3.1 python3-cryptography-debuginfo-2.1.4-4.3.1 References: https://www.suse.com/security/cve/CVE-2018-10903.html https://bugzilla.suse.com/1101820 _______________________________________________ sle-security-updates mailinglist This email address is being protected from spambots. You need JavaScript enabled to view it. http://lists.suse.com/mailman/listinfo/sle-security-updates . SUSE Security Patch for python-cryptography resolves significant vulnerabilities with a moderate severity level.. SUSE Linux, python-cryptography update, security patch, software vulnerability. . LinuxSecurity.com Team

Oct 24, 2018 SuSE