[USN-6539-1] python-cryptography vulnerabilities

[Marc Deslauriers]

==========================================================================
Ubuntu Security Notice USN-6539-1
December 06, 2023

python-cryptography vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 23.10
- Ubuntu 23.04
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS

Summary:

Several security issues were fixed in python-cryptography.

Software Description:
- python-cryptography: Cryptography Python library

Details:

It was discovered that the python-cryptography Cipher.update_into function
would incorrectly accept objects with immutable buffers. This would result
in corrupted output, contrary to expectations. This issue only affected
Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 23.04. (CVE-2023-23931)

It was dicovered that python-cryptography incorrectly handled loading
certain PKCS7 certificates. A remote attacker could possibly use this
issue to cause python-cryptography to crash, resulting in a denial of
service. This issue only affected Ubuntu 22.04 LTS, Ubuntu 23.04, and
Ubuntu 23.10. (CVE-2023-49083)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 23.10:
   python3-cryptography            38.0.4-4ubuntu0.23.10.1

Ubuntu 23.04:
   python3-cryptography            38.0.4-2ubuntu0.1

Ubuntu 22.04 LTS:
   python3-cryptography            3.4.8-1ubuntu2.1

Ubuntu 20.04 LTS:
   python-cryptography             2.8-3ubuntu0.2
   python3-cryptography            2.8-3ubuntu0.2

In general, a standard system update will make all the necessary changes.

References:
   https://ubuntu.com/security/notices/USN-6539-1
   CVE-2023-23931, CVE-2023-49083

Package Information:
   https://launchpad.net/ubuntu/+source/python-cryptography/38.0.4-4ubuntu0.23.10.1
   https://launchpad.net/ubuntu/+source/python-cryptography/38.0.4-2ubuntu0.1
   https://launchpad.net/ubuntu/+source/python-cryptography/3.4.8-1ubuntu2.1
   https://launchpad.net/ubuntu/+source/python-cryptography/2.8-3ubuntu0.2

-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20231206/11b0d664/attachment-0001.sig>