Summary
It was discovered that Python did not properly provide constant-time
processing for a crypto operation. An attacker could possibly use this
issue to perform a timing attack and recover sensitive information.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | python2.7 | 2.7.12-1ubuntu0~16.04.18+esm7 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | python3.5 | 3.5.2-2ubuntu0~16.04.13+esm11 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | python2.7 | 2.7.17-1~18.04ubuntu1.13+esm2 |
Vulnerabilities 1
-
Unscored —
An issue was discovered in compare_digest in Lib/hmac.py in Python through 3.9.1. Constant-time-defeating optimisations…
References
-
report
https://ubuntu.com/security/CVE-2022-48566