USN-3138-1 — python-cryptography vulnerability

Summary

Markus Döring discovered that python-cryptography incorrectly handled
certain HKDF lengths. This could result in python-cryptography returning an
empty string instead of the expected derived key.

Fixed packages 1

Release	Package	Fixed in
Ubuntu · 16.04 LTS 16.04:LTS	python-cryptography	1.2.3-1ubuntu0.1

Vulnerabilities 1

High 7.5

CVE-2016-9243

Improper input validation in cryptography

HKDF in cryptography before 1.5.2 returns an empty byte-string if used with a length less than algorithm.digest_size.

cryptography python-cryptography python-cryptography Debian Ubuntu PyPI

Mar 27, 2017

References

report
https://ubuntu.com/security/CVE-2016-9243

python-cryptography vulnerability

Summary

Fixed packages 1

Vulnerabilities 1

Improper input validation in cryptography

References