Security
Headlines
HeadlinesLatestCVEs

Headline

Ubuntu Security Notice USN-6673-3

Ubuntu Security Notice 6673-3 - USN-6673-1 provided a security update for python-cryptography. This update provides the corresponding update for Ubuntu 24.04 LTS. It was discovered that python-cryptography incorrectly handled memory operations when processing mismatched PKCS#12 keys. A remote attacker could possibly use this issue to cause python-cryptography to crash, leading to a denial of service. This issue only affected Ubuntu 23.10.

Packet Storm
#vulnerability#ubuntu#dos

==========================================================================
Ubuntu Security Notice USN-6673-3
May 27, 2024

python-cryptography vulnerability

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 24.04 LTS

Summary:

python-cryptography could be made to crash if it received specially crafted
input.

Software Description:

  • python-cryptography: Cryptography Python library

Details:

USN-6673-1 provided a security update for python-cryptography.
This update provides the corresponding update for Ubuntu 24.04 LTS.

Original advisory details:

It was discovered that python-cryptography incorrectly handled memory
operations when processing mismatched PKCS#12 keys. A remote attacker could
possibly use this issue to cause python-cryptography to crash, leading to a
denial of service. This issue only affected Ubuntu 23.10. (CVE-2024-26130)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 24.04 LTS
python3-cryptography 41.0.7-4ubuntu0.1

In general, a standard system update will make all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-6673-3
https://ubuntu.com/security/notices/USN-6673-1
CVE-2024-26130

Package Information:
https://launchpad.net/ubuntu/+source/python-cryptography/41.0.7-4ubuntu0.1

Related news

Red Hat Security Advisory 2024-7987-03

Red Hat Security Advisory 2024-7987-03 - An update is now available for Red Hat Satellite 6.15 for RHEL 8. Issues addressed include HTTP request smuggling and null pointer vulnerabilities.

Gentoo Linux Security Advisory 202407-06

Gentoo Linux Security Advisory 202407-6 - Multiple vulnerabilities have been discovered in cryptography, the worst of which could lead to a denial of service. Versions greater than or equal to 42.0.4 are affected.

Red Hat Security Advisory 2024-3781-03

Red Hat Security Advisory 2024-3781-03 - An update is now available for Red Hat Ansible Automation Platform 2.4. Issues addressed include HTTP request smuggling, buffer overflow, code execution, cross site scripting, denial of service, memory exhaustion, null pointer, and password leak vulnerabilities.

Ubuntu Security Notice USN-6673-1

Ubuntu Security Notice 6673-1 - Hubert Kario discovered that python-cryptography incorrectly handled errors returned by the OpenSSL API when processing incorrect padding in RSA PKCS#1 v1.5. A remote attacker could possibly use this issue to expose confidential or sensitive information. It was discovered that python-cryptography incorrectly handled memory operations when processing mismatched PKCS#12 keys. A remote attacker could possibly use this issue to cause python-cryptography to crash, leading to a denial of service. This issue only affected Ubuntu 23.10.

GHSA-6vqw-3v5j-54x4: cryptography NULL pointer deference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override

If `pkcs12.serialize_key_and_certificates` is called with both: 1. A certificate whose public key did not match the provided private key 2. An `encryption_algorithm` with `hmac_hash` set (via `PrivateFormat.PKCS12.encryption_builder().hmac_hash(...)` Then a NULL pointer dereference would occur, crashing the Python process. This has been resolved, and now a `ValueError` is properly raised. Patched in https://github.com/pyca/cryptography/pull/10423

Packet Storm: Latest News

Ivanti EPM Agent Portal Command Execution