Описание
A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 7 | python-cryptography | Not affected | ||
| Red Hat Enterprise Linux 8 | python-cryptography | Not affected | ||
| Red Hat Enterprise Linux OpenStack Platform 7 (Kilo) | python-cryptography | Not affected | ||
| Red Hat OpenStack Platform 14 (Rocky) | python-cryptography | Affected | ||
| Red Hat OpenStack Platform 8 (Liberty) | python-cryptography | Not affected | ||
| Red Hat OpenStack Platform 9 (Mitaka) | python-cryptography | Not affected | ||
| Red Hat Virtualization 4 | python-cryptography | Not affected | ||
| Red Hat OpenStack Platform 13.0 (Queens) | python-cryptography | Fixed | RHSA-2018:3600 | 13.11.2018 |
Показывать по
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.
A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.
A flaw was found in python-cryptography versions between >=1.9.0 and < ...
Security update for python-cryptography, python-cryptography-vectors
EPSS
7.5 High
CVSS3