Fedora 27 : python-cryptography / python-cryptography-vectors (2018-06c24068c6)

High Nessus Plugin ID 111469

Synopsis

The remote Fedora host is missing one or more security updates.

Description

# New upstream release 2.3

Fixes possible tag truncation security bug in AEAD API, see
RHBZ#1602752

## 2.3 - 2018-07-18

- SECURITY ISSUE: finalize_with_tag() allowed tag
truncation by default which can allow tag forgery in
some cases. The method now enforces the min_tag_length
provided to the GCM constructor.

- Added support for Python 3.7.

- Added extract_timestamp() to get the authenticated
timestamp of a Fernet token.

- Support for Python 2.7.x without hmac.compare_digest has
been deprecated. We will require Python 2.7.7 or higher
(or 2.7.6 on Ubuntu) in the next cryptography release.

- Fixed multiple issues preventing cryptography from
compiling against LibreSSL 2.7.x.

- Added get_revoked_certificate_by_serial_number for quick
serial number searches in CRLs.

- The RelativeDistinguishedName class now preserves the
order of attributes. Duplicate attributes now raise an
error instead of silently discarding duplicates.

- aes_key_unwrap() and aes_key_unwrap_with_padding() now
raise InvalidUnwrap if the wrapped key is an invalid
length, instead of ValueError.

Note that Tenable Network Security has extracted the preceding
description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as
possible without introducing additional issues.

Solution

Update the affected python-cryptography and / or
python-cryptography-vectors packages.

See Also

https://bodhi.fedoraproject.org/updates/FEDORA-2018-06c24068c6

Plugin Details

Severity: High

ID: 111469

File Name: fedora_2018-06c24068c6.nasl

Version: 1.1

Type: local

Agent: unix

Published: 2018/08/02

Modified: 2018/08/02

Dependencies: 12634

Risk Information

Risk Factor: High

Vulnerability Information

CPE: p-cpe:/a:fedoraproject:fedora:python-cryptography, p-cpe:/a:fedoraproject:fedora:python-cryptography-vectors, cpe:/o:fedoraproject:fedora:27

Patch Publication Date: 2018/07/31

Reference Information