USN-6539-1: python-cryptography vulnerabilities

Releases

• Ubuntu 23.10
• Ubuntu 23.04
• Ubuntu 22.04 LTS
• Ubuntu 20.04 LTS

Packages

• python-cryptography - Cryptography Python library

Details

It was discovered that the python-cryptography Cipher.update_into function
would incorrectly accept objects with immutable buffers. This would result
in corrupted output, contrary to expectations. This issue only affected
Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 23.04. (CVE-2023-23931)

It was dicovered that python-cryptography incorrectly handled loading
certain PKCS7 certificates. A remote attacker could possibly use this
issue to cause python-cryptography to crash, resulting in a denial of
service. This issue only affected Ubuntu 22.04 LTS, Ubuntu 23.04, and
Ubuntu 23.10. (CVE-2023-49083)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 23.10

• python3-cryptography - 38.0.4-4ubuntu0.23.10.1

Ubuntu 23.04

• python3-cryptography - 38.0.4-2ubuntu0.1

Ubuntu 22.04

• python3-cryptography - 3.4.8-1ubuntu2.1

Ubuntu 20.04

• python-cryptography - 2.8-3ubuntu0.2
• python3-cryptography - 2.8-3ubuntu0.2

In general, a standard system update will make all the necessary changes.

References

• CVE-2023-49083
• CVE-2023-23931