Red Hat Security AdvisoryRHSA-2021:1608
python-cryptography security, bug fix, and enhancement update
Released 2021-05-18 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux BaseOS (v. 8) python-cryptography-3.2.1-4.el8, python3-cryptography-3.2.1-4.el8
Fixes 2 records
Priority MEDIUM 49
In the cryptography package before 3.3.2 for Python, certain sequences of update calls to symmetrically encrypt multi-GB values could result in an integer overflow and buffer overflow, as demonstrated by the Fernet class…
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.06799 · Published 2021-02-07 · Partial fix · 3.3.2 CWE-190
Priority LOW 31
python-cryptography 3.2 is vulnerable to Bleichenbacher timing attacks in the RSA decryption API, via timed processing of valid PKCS#1 v1.5 ciphertext.
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.02463 · Published 2021-01-11 · Partial fix · 3.2 CWE-385
