USN-6673-1: python-cryptography vulnerabilities

Releases

• Ubuntu 23.10
• Ubuntu 22.04 LTS
• Ubuntu 20.04 LTS
• Ubuntu 18.04 ESM

Packages

• python-cryptography - Cryptography Python library

Details

Hubert Kario discovered that python-cryptography incorrectly handled
errors returned by the OpenSSL API when processing incorrect padding in
RSA PKCS#1 v1.5. A remote attacker could possibly use this issue to expose
confidential or sensitive information. (CVE-2023-50782)

It was discovered that python-cryptography incorrectly handled memory
operations when processing mismatched PKCS#12 keys. A remote attacker could
possibly use this issue to cause python-cryptography to crash, leading to a
denial of service. This issue only affected Ubuntu 23.10. (CVE-2024-26130)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 23.10

• python3-cryptography - 38.0.4-4ubuntu0.23.10.2

Ubuntu 22.04

• python3-cryptography - 3.4.8-1ubuntu2.2

Ubuntu 20.04

• python-cryptography - 2.8-3ubuntu0.3
• python3-cryptography - 2.8-3ubuntu0.3

Ubuntu 18.04

• python-cryptography - 2.1.4-1ubuntu1.4+esm1
  Available with Ubuntu Pro
• python3-cryptography - 2.1.4-1ubuntu1.4+esm1
  Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References

• CVE-2024-26130
• CVE-2023-50782

Related notices

• USN-6673-3: python-cryptography, python3-cryptography, python-cryptography-doc
• USN-6673-2: python-cryptography, python3-cryptography, python-cryptography-doc