VulnerableCode Package Details - pkg:deb/ubuntu/python-cryptography@0.6.1-1ubuntu1

Search for packages

Vulnerability	Summary	Fixed by
VCID-1vvs-dn11-aaak Aliases: CVE-2020-25659 GHSA-hggm-jpg3-v476 PYSEC-2021-62	python-cryptography 3.2 is vulnerable to Bleichenbacher timing attacks in the RSA decryption API, via timed processing of valid PKCS#1 v1.5 ciphertext.	2.8-3ubuntu0.1 Affected by 0 other vulnerabilities.
VCID-69da-bw9p-aaae Aliases: CVE-2018-10903 GHSA-fcf9-3qw3-gxmj PYSEC-2018-52	A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.	2.1.4-1ubuntu1.2 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-ec7h-g27n-aaad Aliases: CVE-2016-9243 GHSA-q3cj-2r34-2cwc PYSEC-2017-8	HKDF in cryptography before 1.5.2 returns an empty byte-string if used with a length less than algorithm.digest_size.	1.2.3-1ubuntu0.1 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-j6cb-jtt4-aaas Aliases: CVE-2020-36242 GHSA-rhm9-p9w5-fwm7 PYSEC-2021-63	In the cryptography package before 3.3.2 for Python, certain sequences of update calls to symmetrically encrypt multi-GB values could result in an integer overflow and buffer overflow, as demonstrated by the Fernet class.	2.8-3ubuntu0.1 Affected by 0 other vulnerabilities.

Vulnerability

Summary

Fixed by

VCID-1vvs-dn11-aaak
Aliases:
CVE-2020-25659
GHSA-hggm-jpg3-v476
PYSEC-2021-62

python-cryptography 3.2 is vulnerable to Bleichenbacher timing attacks in the RSA decryption API, via timed processing of valid PKCS#1 v1.5 ciphertext.

2.8-3ubuntu0.1
Affected by 0 other vulnerabilities.

VCID-69da-bw9p-aaae
Aliases:
CVE-2018-10903
GHSA-fcf9-3qw3-gxmj
PYSEC-2018-52

A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.

2.1.4-1ubuntu1.2
Affected by 2 other vulnerabilities.

VCID-ec7h-g27n-aaad
Aliases:
CVE-2016-9243
GHSA-q3cj-2r34-2cwc
PYSEC-2017-8

HKDF in cryptography before 1.5.2 returns an empty byte-string if used with a length less than algorithm.digest_size.

1.2.3-1ubuntu0.1
Affected by 3 other vulnerabilities.

VCID-j6cb-jtt4-aaas
Aliases:
CVE-2020-36242
GHSA-rhm9-p9w5-fwm7
PYSEC-2021-63

In the cryptography package before 3.3.2 for Python, certain sequences of update calls to symmetrically encrypt multi-GB values could result in an integer overflow and buffer overflow, as demonstrated by the Fernet class.

2.8-3ubuntu0.1
Affected by 0 other vulnerabilities.

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Vulnerability

Summary

Aliases

This package is not known to fix vulnerabilities.

Next non-vulnerable version	2.8-3ubuntu0.1
Latest non-vulnerable version	2.8-3ubuntu0.1
Risk	4.5