Lucene search

K
suseSuseOPENSUSE-SU-2018:3445-1
HistoryOct 25, 2018 - 6:17 p.m.

Security update for python-cryptography (moderate)

2018-10-2518:17:44
lists.opensuse.org
344

0.002 Low

EPSS

Percentile

55.0%

This update for python-cryptography fixes the following issues:

  • CVE-2018-10903: The finalize_with_tag API did not enforce a minimum tag
    length. If a user did not validate the input length prior to passing it
    to finalize_with_tag an attacker could craft an invalid payload with a
    shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance
    of passing the MAC check. GCM tag forgeries could have caused key
    leakage (bsc#1101820).

This update was imported from the SUSE:SLE-15:Update update project.