Summary
It was discovered that python-cryptography incorrectly handled certain inputs.
An attacker could possibly use this to get access to sensitive information.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 18.04 LTS 18.04:LTS | python-cryptography | 2.1.4-1ubuntu1.2 |
Vulnerabilities 1
-
High 7.5
PyCA Cryptography vulnerable to GCM tag forgery
A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid …
References
-
report
https://ubuntu.com/security/CVE-2018-10903