rhsa-2021_1608
Vulnerability from csaf_redhat
Published
2021-05-18 15:21
Modified
2024-09-13 18:18
Summary
Red Hat Security Advisory: python-cryptography security, bug fix, and enhancement update

Notes

Topic
An update for python-cryptography is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
The python-cryptography packages contain a Python Cryptographic Authority's (PyCA's) cryptography library, which provides cryptographic primitives and recipes to Python developers. The following packages have been upgraded to a later upstream version: python-cryptography (3.2.1). (BZ#1873581, BZ#1891947) Security Fix(es): * python-cryptography: bleichenbacher timing oracle attack against RSA decryption (CVE-2020-25659) * python-cryptography: certain sequences of update() calls when symmetrically encrypting very large payloads could result in an integer overflow and lead to buffer overflows (CVE-2020-36242) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.4 Release Notes linked from the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for python-cryptography is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The python-cryptography packages contain a Python Cryptographic Authority\u0027s (PyCA\u0027s) cryptography library, which provides cryptographic primitives and recipes to Python developers.\n\nThe following packages have been upgraded to a later upstream version: python-cryptography (3.2.1). (BZ#1873581, BZ#1891947)\n\nSecurity Fix(es):\n\n* python-cryptography: bleichenbacher timing oracle attack against RSA decryption (CVE-2020-25659)\n\n* python-cryptography: certain sequences of update() calls when symmetrically encrypting very large payloads could result in an integer overflow and lead to buffer overflows (CVE-2020-36242)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Red Hat Enterprise Linux 8.4 Release Notes linked from the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat offerings.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2021:1608",
        "url": "https://access.redhat.com/errata/RHSA-2021:1608"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.4_release_notes/",
        "url": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.4_release_notes/"
      },
      {
        "category": "external",
        "summary": "1778939",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1778939"
      },
      {
        "category": "external",
        "summary": "1873581",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1873581"
      },
      {
        "category": "external",
        "summary": "1889988",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1889988"
      },
      {
        "category": "external",
        "summary": "1891947",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1891947"
      },
      {
        "category": "external",
        "summary": "1907429",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1907429"
      },
      {
        "category": "external",
        "summary": "1926226",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1926226"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://access.redhat.com/security/data/csaf/v2/advisories/2021/rhsa-2021_1608.json"
      }
    ],
    "title": "Red Hat Security Advisory: python-cryptography security, bug fix, and enhancement update",
    "tracking": {
      "current_release_date": "2024-09-13T18:18:23+00:00",
      "generator": {
        "date": "2024-09-13T18:18:23+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "3.33.3"
        }
      },
      "id": "RHSA-2021:1608",
      "initial_release_date": "2021-05-18T15:21:33+00:00",
      "revision_history": [
        {
          "date": "2021-05-18T15:21:33+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2021-05-18T15:21:33+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-09-13T18:18:23+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux BaseOS (v. 8)",
                "product": {
                  "name": "Red Hat Enterprise Linux BaseOS (v. 8)",
                  "product_id": "BaseOS-8.4.0.GA",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:8::baseos"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python-cryptography-0:3.2.1-4.el8.src",
                "product": {
                  "name": "python-cryptography-0:3.2.1-4.el8.src",
                  "product_id": "python-cryptography-0:3.2.1-4.el8.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python-cryptography@3.2.1-4.el8?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python3-cryptography-0:3.2.1-4.el8.aarch64",
                "product": {
                  "name": "python3-cryptography-0:3.2.1-4.el8.aarch64",
                  "product_id": "python3-cryptography-0:3.2.1-4.el8.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python3-cryptography@3.2.1-4.el8?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python-cryptography-debugsource-0:3.2.1-4.el8.aarch64",
                "product": {
                  "name": "python-cryptography-debugsource-0:3.2.1-4.el8.aarch64",
                  "product_id": "python-cryptography-debugsource-0:3.2.1-4.el8.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python-cryptography-debugsource@3.2.1-4.el8?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python3-cryptography-debuginfo-0:3.2.1-4.el8.aarch64",
                "product": {
                  "name": "python3-cryptography-debuginfo-0:3.2.1-4.el8.aarch64",
                  "product_id": "python3-cryptography-debuginfo-0:3.2.1-4.el8.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python3-cryptography-debuginfo@3.2.1-4.el8?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python3-cryptography-0:3.2.1-4.el8.ppc64le",
                "product": {
                  "name": "python3-cryptography-0:3.2.1-4.el8.ppc64le",
                  "product_id": "python3-cryptography-0:3.2.1-4.el8.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python3-cryptography@3.2.1-4.el8?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python-cryptography-debugsource-0:3.2.1-4.el8.ppc64le",
                "product": {
                  "name": "python-cryptography-debugsource-0:3.2.1-4.el8.ppc64le",
                  "product_id": "python-cryptography-debugsource-0:3.2.1-4.el8.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python-cryptography-debugsource@3.2.1-4.el8?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python3-cryptography-debuginfo-0:3.2.1-4.el8.ppc64le",
                "product": {
                  "name": "python3-cryptography-debuginfo-0:3.2.1-4.el8.ppc64le",
                  "product_id": "python3-cryptography-debuginfo-0:3.2.1-4.el8.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python3-cryptography-debuginfo@3.2.1-4.el8?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python3-cryptography-0:3.2.1-4.el8.x86_64",
                "product": {
                  "name": "python3-cryptography-0:3.2.1-4.el8.x86_64",
                  "product_id": "python3-cryptography-0:3.2.1-4.el8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python3-cryptography@3.2.1-4.el8?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python-cryptography-debugsource-0:3.2.1-4.el8.x86_64",
                "product": {
                  "name": "python-cryptography-debugsource-0:3.2.1-4.el8.x86_64",
                  "product_id": "python-cryptography-debugsource-0:3.2.1-4.el8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python-cryptography-debugsource@3.2.1-4.el8?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python3-cryptography-debuginfo-0:3.2.1-4.el8.x86_64",
                "product": {
                  "name": "python3-cryptography-debuginfo-0:3.2.1-4.el8.x86_64",
                  "product_id": "python3-cryptography-debuginfo-0:3.2.1-4.el8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python3-cryptography-debuginfo@3.2.1-4.el8?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python3-cryptography-0:3.2.1-4.el8.s390x",
                "product": {
                  "name": "python3-cryptography-0:3.2.1-4.el8.s390x",
                  "product_id": "python3-cryptography-0:3.2.1-4.el8.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python3-cryptography@3.2.1-4.el8?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python-cryptography-debugsource-0:3.2.1-4.el8.s390x",
                "product": {
                  "name": "python-cryptography-debugsource-0:3.2.1-4.el8.s390x",
                  "product_id": "python-cryptography-debugsource-0:3.2.1-4.el8.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python-cryptography-debugsource@3.2.1-4.el8?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python3-cryptography-debuginfo-0:3.2.1-4.el8.s390x",
                "product": {
                  "name": "python3-cryptography-debuginfo-0:3.2.1-4.el8.s390x",
                  "product_id": "python3-cryptography-debuginfo-0:3.2.1-4.el8.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python3-cryptography-debuginfo@3.2.1-4.el8?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python-cryptography-0:3.2.1-4.el8.src as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.4.0.GA:python-cryptography-0:3.2.1-4.el8.src"
        },
        "product_reference": "python-cryptography-0:3.2.1-4.el8.src",
        "relates_to_product_reference": "BaseOS-8.4.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python-cryptography-debugsource-0:3.2.1-4.el8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.4.0.GA:python-cryptography-debugsource-0:3.2.1-4.el8.aarch64"
        },
        "product_reference": "python-cryptography-debugsource-0:3.2.1-4.el8.aarch64",
        "relates_to_product_reference": "BaseOS-8.4.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python-cryptography-debugsource-0:3.2.1-4.el8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.4.0.GA:python-cryptography-debugsource-0:3.2.1-4.el8.ppc64le"
        },
        "product_reference": "python-cryptography-debugsource-0:3.2.1-4.el8.ppc64le",
        "relates_to_product_reference": "BaseOS-8.4.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python-cryptography-debugsource-0:3.2.1-4.el8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.4.0.GA:python-cryptography-debugsource-0:3.2.1-4.el8.s390x"
        },
        "product_reference": "python-cryptography-debugsource-0:3.2.1-4.el8.s390x",
        "relates_to_product_reference": "BaseOS-8.4.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python-cryptography-debugsource-0:3.2.1-4.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.4.0.GA:python-cryptography-debugsource-0:3.2.1-4.el8.x86_64"
        },
        "product_reference": "python-cryptography-debugsource-0:3.2.1-4.el8.x86_64",
        "relates_to_product_reference": "BaseOS-8.4.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3-cryptography-0:3.2.1-4.el8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.4.0.GA:python3-cryptography-0:3.2.1-4.el8.aarch64"
        },
        "product_reference": "python3-cryptography-0:3.2.1-4.el8.aarch64",
        "relates_to_product_reference": "BaseOS-8.4.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3-cryptography-0:3.2.1-4.el8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.4.0.GA:python3-cryptography-0:3.2.1-4.el8.ppc64le"
        },
        "product_reference": "python3-cryptography-0:3.2.1-4.el8.ppc64le",
        "relates_to_product_reference": "BaseOS-8.4.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3-cryptography-0:3.2.1-4.el8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.4.0.GA:python3-cryptography-0:3.2.1-4.el8.s390x"
        },
        "product_reference": "python3-cryptography-0:3.2.1-4.el8.s390x",
        "relates_to_product_reference": "BaseOS-8.4.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3-cryptography-0:3.2.1-4.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.4.0.GA:python3-cryptography-0:3.2.1-4.el8.x86_64"
        },
        "product_reference": "python3-cryptography-0:3.2.1-4.el8.x86_64",
        "relates_to_product_reference": "BaseOS-8.4.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3-cryptography-debuginfo-0:3.2.1-4.el8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.4.0.GA:python3-cryptography-debuginfo-0:3.2.1-4.el8.aarch64"
        },
        "product_reference": "python3-cryptography-debuginfo-0:3.2.1-4.el8.aarch64",
        "relates_to_product_reference": "BaseOS-8.4.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3-cryptography-debuginfo-0:3.2.1-4.el8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.4.0.GA:python3-cryptography-debuginfo-0:3.2.1-4.el8.ppc64le"
        },
        "product_reference": "python3-cryptography-debuginfo-0:3.2.1-4.el8.ppc64le",
        "relates_to_product_reference": "BaseOS-8.4.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3-cryptography-debuginfo-0:3.2.1-4.el8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.4.0.GA:python3-cryptography-debuginfo-0:3.2.1-4.el8.s390x"
        },
        "product_reference": "python3-cryptography-debuginfo-0:3.2.1-4.el8.s390x",
        "relates_to_product_reference": "BaseOS-8.4.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3-cryptography-debuginfo-0:3.2.1-4.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)",
          "product_id": "BaseOS-8.4.0.GA:python3-cryptography-debuginfo-0:3.2.1-4.el8.x86_64"
        },
        "product_reference": "python3-cryptography-debuginfo-0:3.2.1-4.el8.x86_64",
        "relates_to_product_reference": "BaseOS-8.4.0.GA"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Hubert Kario"
          ],
          "organization": "Red Hat",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2020-25659",
      "cwe": {
        "id": "CWE-385",
        "name": "Covert Timing Channel"
      },
      "discovery_date": "2020-10-21T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1889988"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in python-cryptography, where it is vulnerable to Bleichenbacher timing attacks. This flaw allows an attacker, via the RSA decryption API, to decrypt parts of the ciphertext encrypted with RSA. The highest threat from this vulnerability is to confidentiality.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "python-cryptography: Bleichenbacher timing oracle attack against RSA decryption",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "In Red Hat OpenStack Platform, because the flaw has a lower impact and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP python-cryptography package.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "BaseOS-8.4.0.GA:python-cryptography-0:3.2.1-4.el8.src",
          "BaseOS-8.4.0.GA:python-cryptography-debugsource-0:3.2.1-4.el8.aarch64",
          "BaseOS-8.4.0.GA:python-cryptography-debugsource-0:3.2.1-4.el8.ppc64le",
          "BaseOS-8.4.0.GA:python-cryptography-debugsource-0:3.2.1-4.el8.s390x",
          "BaseOS-8.4.0.GA:python-cryptography-debugsource-0:3.2.1-4.el8.x86_64",
          "BaseOS-8.4.0.GA:python3-cryptography-0:3.2.1-4.el8.aarch64",
          "BaseOS-8.4.0.GA:python3-cryptography-0:3.2.1-4.el8.ppc64le",
          "BaseOS-8.4.0.GA:python3-cryptography-0:3.2.1-4.el8.s390x",
          "BaseOS-8.4.0.GA:python3-cryptography-0:3.2.1-4.el8.x86_64",
          "BaseOS-8.4.0.GA:python3-cryptography-debuginfo-0:3.2.1-4.el8.aarch64",
          "BaseOS-8.4.0.GA:python3-cryptography-debuginfo-0:3.2.1-4.el8.ppc64le",
          "BaseOS-8.4.0.GA:python3-cryptography-debuginfo-0:3.2.1-4.el8.s390x",
          "BaseOS-8.4.0.GA:python3-cryptography-debuginfo-0:3.2.1-4.el8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2020-25659"
        },
        {
          "category": "external",
          "summary": "RHBZ#1889988",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1889988"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2020-25659",
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-25659"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-25659",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25659"
        },
        {
          "category": "external",
          "summary": "https://cryptography.io/en/latest/changelog.html#v3-2",
          "url": "https://cryptography.io/en/latest/changelog.html#v3-2"
        }
      ],
      "release_date": "2020-10-25T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "BaseOS-8.4.0.GA:python-cryptography-0:3.2.1-4.el8.src",
            "BaseOS-8.4.0.GA:python-cryptography-debugsource-0:3.2.1-4.el8.aarch64",
            "BaseOS-8.4.0.GA:python-cryptography-debugsource-0:3.2.1-4.el8.ppc64le",
            "BaseOS-8.4.0.GA:python-cryptography-debugsource-0:3.2.1-4.el8.s390x",
            "BaseOS-8.4.0.GA:python-cryptography-debugsource-0:3.2.1-4.el8.x86_64",
            "BaseOS-8.4.0.GA:python3-cryptography-0:3.2.1-4.el8.aarch64",
            "BaseOS-8.4.0.GA:python3-cryptography-0:3.2.1-4.el8.ppc64le",
            "BaseOS-8.4.0.GA:python3-cryptography-0:3.2.1-4.el8.s390x",
            "BaseOS-8.4.0.GA:python3-cryptography-0:3.2.1-4.el8.x86_64",
            "BaseOS-8.4.0.GA:python3-cryptography-debuginfo-0:3.2.1-4.el8.aarch64",
            "BaseOS-8.4.0.GA:python3-cryptography-debuginfo-0:3.2.1-4.el8.ppc64le",
            "BaseOS-8.4.0.GA:python3-cryptography-debuginfo-0:3.2.1-4.el8.s390x",
            "BaseOS-8.4.0.GA:python3-cryptography-debuginfo-0:3.2.1-4.el8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2021:1608"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "BaseOS-8.4.0.GA:python-cryptography-0:3.2.1-4.el8.src",
            "BaseOS-8.4.0.GA:python-cryptography-debugsource-0:3.2.1-4.el8.aarch64",
            "BaseOS-8.4.0.GA:python-cryptography-debugsource-0:3.2.1-4.el8.ppc64le",
            "BaseOS-8.4.0.GA:python-cryptography-debugsource-0:3.2.1-4.el8.s390x",
            "BaseOS-8.4.0.GA:python-cryptography-debugsource-0:3.2.1-4.el8.x86_64",
            "BaseOS-8.4.0.GA:python3-cryptography-0:3.2.1-4.el8.aarch64",
            "BaseOS-8.4.0.GA:python3-cryptography-0:3.2.1-4.el8.ppc64le",
            "BaseOS-8.4.0.GA:python3-cryptography-0:3.2.1-4.el8.s390x",
            "BaseOS-8.4.0.GA:python3-cryptography-0:3.2.1-4.el8.x86_64",
            "BaseOS-8.4.0.GA:python3-cryptography-debuginfo-0:3.2.1-4.el8.aarch64",
            "BaseOS-8.4.0.GA:python3-cryptography-debuginfo-0:3.2.1-4.el8.ppc64le",
            "BaseOS-8.4.0.GA:python3-cryptography-debuginfo-0:3.2.1-4.el8.s390x",
            "BaseOS-8.4.0.GA:python3-cryptography-debuginfo-0:3.2.1-4.el8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "python-cryptography: Bleichenbacher timing oracle attack against RSA decryption"
    },
    {
      "cve": "CVE-2020-36242",
      "cwe": {
        "id": "CWE-119",
        "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
      },
      "discovery_date": "2021-02-07T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1926226"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A buffer-overflow flaw was found in the python-cryptography package. In certain sequences of ``update()`` calls when symmetrically encrypting very large payloads (\u003e2GB) could result in an integer overflow, leading to buffer overflows. Note: This fix is a workaround for the OpenSSL CVE-2021-23840 flaw. Source: pyca/cryptography project",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "python-cryptography: Large inputs for symmetric encryption can trigger integer overflow leading to buffer overflow",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Triggering this flaw on in versions of python-cryptography as shipped with Red Hat Enterprise Linux 8 BaseOS, Appstream, as well as Red Hat Software Collections, can result in denial of service due to memory consumption or MemoryError exception.\n\nIn Red Hat OpenStack Platform, because the flaw has a lower impact and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP python-cryptography package.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "BaseOS-8.4.0.GA:python-cryptography-0:3.2.1-4.el8.src",
          "BaseOS-8.4.0.GA:python-cryptography-debugsource-0:3.2.1-4.el8.aarch64",
          "BaseOS-8.4.0.GA:python-cryptography-debugsource-0:3.2.1-4.el8.ppc64le",
          "BaseOS-8.4.0.GA:python-cryptography-debugsource-0:3.2.1-4.el8.s390x",
          "BaseOS-8.4.0.GA:python-cryptography-debugsource-0:3.2.1-4.el8.x86_64",
          "BaseOS-8.4.0.GA:python3-cryptography-0:3.2.1-4.el8.aarch64",
          "BaseOS-8.4.0.GA:python3-cryptography-0:3.2.1-4.el8.ppc64le",
          "BaseOS-8.4.0.GA:python3-cryptography-0:3.2.1-4.el8.s390x",
          "BaseOS-8.4.0.GA:python3-cryptography-0:3.2.1-4.el8.x86_64",
          "BaseOS-8.4.0.GA:python3-cryptography-debuginfo-0:3.2.1-4.el8.aarch64",
          "BaseOS-8.4.0.GA:python3-cryptography-debuginfo-0:3.2.1-4.el8.ppc64le",
          "BaseOS-8.4.0.GA:python3-cryptography-debuginfo-0:3.2.1-4.el8.s390x",
          "BaseOS-8.4.0.GA:python3-cryptography-debuginfo-0:3.2.1-4.el8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2020-36242"
        },
        {
          "category": "external",
          "summary": "RHBZ#1926226",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1926226"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2020-36242",
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-36242"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-36242",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36242"
        },
        {
          "category": "external",
          "summary": "https://cryptography.io/en/latest/changelog.html#v3-3-2",
          "url": "https://cryptography.io/en/latest/changelog.html#v3-3-2"
        }
      ],
      "release_date": "2020-12-09T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "BaseOS-8.4.0.GA:python-cryptography-0:3.2.1-4.el8.src",
            "BaseOS-8.4.0.GA:python-cryptography-debugsource-0:3.2.1-4.el8.aarch64",
            "BaseOS-8.4.0.GA:python-cryptography-debugsource-0:3.2.1-4.el8.ppc64le",
            "BaseOS-8.4.0.GA:python-cryptography-debugsource-0:3.2.1-4.el8.s390x",
            "BaseOS-8.4.0.GA:python-cryptography-debugsource-0:3.2.1-4.el8.x86_64",
            "BaseOS-8.4.0.GA:python3-cryptography-0:3.2.1-4.el8.aarch64",
            "BaseOS-8.4.0.GA:python3-cryptography-0:3.2.1-4.el8.ppc64le",
            "BaseOS-8.4.0.GA:python3-cryptography-0:3.2.1-4.el8.s390x",
            "BaseOS-8.4.0.GA:python3-cryptography-0:3.2.1-4.el8.x86_64",
            "BaseOS-8.4.0.GA:python3-cryptography-debuginfo-0:3.2.1-4.el8.aarch64",
            "BaseOS-8.4.0.GA:python3-cryptography-debuginfo-0:3.2.1-4.el8.ppc64le",
            "BaseOS-8.4.0.GA:python3-cryptography-debuginfo-0:3.2.1-4.el8.s390x",
            "BaseOS-8.4.0.GA:python3-cryptography-debuginfo-0:3.2.1-4.el8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2021:1608"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "BaseOS-8.4.0.GA:python-cryptography-0:3.2.1-4.el8.src",
            "BaseOS-8.4.0.GA:python-cryptography-debugsource-0:3.2.1-4.el8.aarch64",
            "BaseOS-8.4.0.GA:python-cryptography-debugsource-0:3.2.1-4.el8.ppc64le",
            "BaseOS-8.4.0.GA:python-cryptography-debugsource-0:3.2.1-4.el8.s390x",
            "BaseOS-8.4.0.GA:python-cryptography-debugsource-0:3.2.1-4.el8.x86_64",
            "BaseOS-8.4.0.GA:python3-cryptography-0:3.2.1-4.el8.aarch64",
            "BaseOS-8.4.0.GA:python3-cryptography-0:3.2.1-4.el8.ppc64le",
            "BaseOS-8.4.0.GA:python3-cryptography-0:3.2.1-4.el8.s390x",
            "BaseOS-8.4.0.GA:python3-cryptography-0:3.2.1-4.el8.x86_64",
            "BaseOS-8.4.0.GA:python3-cryptography-debuginfo-0:3.2.1-4.el8.aarch64",
            "BaseOS-8.4.0.GA:python3-cryptography-debuginfo-0:3.2.1-4.el8.ppc64le",
            "BaseOS-8.4.0.GA:python3-cryptography-debuginfo-0:3.2.1-4.el8.s390x",
            "BaseOS-8.4.0.GA:python3-cryptography-debuginfo-0:3.2.1-4.el8.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "BaseOS-8.4.0.GA:python-cryptography-0:3.2.1-4.el8.src",
            "BaseOS-8.4.0.GA:python-cryptography-debugsource-0:3.2.1-4.el8.aarch64",
            "BaseOS-8.4.0.GA:python-cryptography-debugsource-0:3.2.1-4.el8.ppc64le",
            "BaseOS-8.4.0.GA:python-cryptography-debugsource-0:3.2.1-4.el8.s390x",
            "BaseOS-8.4.0.GA:python-cryptography-debugsource-0:3.2.1-4.el8.x86_64",
            "BaseOS-8.4.0.GA:python3-cryptography-0:3.2.1-4.el8.aarch64",
            "BaseOS-8.4.0.GA:python3-cryptography-0:3.2.1-4.el8.ppc64le",
            "BaseOS-8.4.0.GA:python3-cryptography-0:3.2.1-4.el8.s390x",
            "BaseOS-8.4.0.GA:python3-cryptography-0:3.2.1-4.el8.x86_64",
            "BaseOS-8.4.0.GA:python3-cryptography-debuginfo-0:3.2.1-4.el8.aarch64",
            "BaseOS-8.4.0.GA:python3-cryptography-debuginfo-0:3.2.1-4.el8.ppc64le",
            "BaseOS-8.4.0.GA:python3-cryptography-debuginfo-0:3.2.1-4.el8.s390x",
            "BaseOS-8.4.0.GA:python3-cryptography-debuginfo-0:3.2.1-4.el8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "python-cryptography: Large inputs for symmetric encryption can trigger integer overflow leading to buffer overflow"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.