python-cryptography vulnerability

2024-05-2700:00:00

ubuntu.com

python

cryptography

vulnerability

ubuntu

security update

pkcs#12 keys

denial of service

memory operations

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.5 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

15.5%

JSON

Releases

Ubuntu 24.04 LTS

Packages

python-cryptography - Cryptography Python library

Details

USN-6673-1 provided a security update for python-cryptography.
This update provides the corresponding update for Ubuntu 24.04 LTS.

Original advisory details:

It was discovered that python-cryptography incorrectly handled memory
operations when processing mismatched PKCS#12 keys. A remote attacker could
possibly use this issue to cause python-cryptography to crash, leading to a
denial of service. This issue only affected Ubuntu 23.10. (CVE-2024-26130)

OSVersionArchitecturePackageVersionFilename
Ubuntu24.04noarchpython3-cryptography< 41.0.7-4ubuntu0.1UNKNOWN
Ubuntu24.04noarchpython-cryptography-doc< 41.0.7-4ubuntu0.1UNKNOWN
Ubuntu24.04noarchpython3-cryptography-dbgsym< 41.0.7-4ubuntu0.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
Ubuntu	24.04	noarch	python3-cryptography	< 41.0.7-4ubuntu0.1	UNKNOWN
Ubuntu	24.04	noarch	python-cryptography-doc	< 41.0.7-4ubuntu0.1	UNKNOWN
Ubuntu	24.04	noarch	python3-cryptography-dbgsym	< 41.0.7-4ubuntu0.1	UNKNOWN