Executive Summary
| Summary | |
|---|---|
| Title | Python Crypto regression |
| Informations | |||
|---|---|---|---|
| Name | USN-3199-2 | First vendor Publication | 2017-02-17 |
| Vendor | Ubuntu | Last vendor Modification | 2017-02-17 |
| Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 7.5 | Attack Range | Network |
| Cvss Impact Score | 6.4 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 16.10 - Ubuntu 16.04 LTS - Ubuntu 14.04 LTS Summary: USN-3199-1 introduced a regression in the Python Cryptography Toolkit which caused programs which relied on the original behavior to fail. Software Description: - python-crypto: cryptographic algorithms and protocols for Python Details: USN-3199-1 fixed a vulnerability in the Python Cryptography Toolkit. Unfortunately, various programs depended on the original behavior of the Python Cryptography Toolkit which was altered when fixing the vulnerability. This update retains the fix for the vulnerability but issues a warning rather than throwing an exception. Code which produces this warning should be updated because future versions of the Python Cryptography Toolkit re-introduce the exception. We apologize for the inconvenience. Original advisory details: ﾃつ It was discovered that the ALGnew function in block_template.c in the Python ﾃつ Cryptography Toolkit contained a heap-based buffer overflow vulnerability. ﾃつ A remote attacker could use this flaw to execute arbitrary code by using ﾃつ a crafted initialization vector parameter. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 16.10: ﾃつ python-cryptoﾃつ ﾃつ ﾃつ ﾃつ ﾃつ ﾃつ ﾃつ ﾃつ ﾃつ ﾃつ ﾃつ ﾃつ ﾃつ ﾃつ ﾃつ ﾃつ ﾃつ ﾃつ ﾃつ 2.6.1-6ubuntu0.16.10.3 ﾃつ python3-cryptoﾃつ ﾃつ ﾃつ ﾃつ ﾃつ ﾃつ ﾃつ ﾃつ ﾃつ ﾃつ ﾃつ ﾃつ ﾃつ ﾃつ ﾃつ ﾃつ ﾃつ ﾃつ 2.6.1-6ubuntu0.16.10.3 Ubuntu 16.04 LTS: ﾃつ python-cryptoﾃつ ﾃつ ﾃつ ﾃつ ﾃつ ﾃつ ﾃつ ﾃつ ﾃつ ﾃつ ﾃつ ﾃつ ﾃつ ﾃつ ﾃつ ﾃつ ﾃつ ﾃつ ﾃつ 2.6.1-6ubuntu0.16.04.2 ﾃつ python3-cryptoﾃつ ﾃつ ﾃつ ﾃつ ﾃつ ﾃつ ﾃつ ﾃつ ﾃつ ﾃつ ﾃつ ﾃつ ﾃつ ﾃつ ﾃつ ﾃつ ﾃつ ﾃつ 2.6.1-6ubuntu0.16.04.2 Ubuntu 14.04 LTS: ﾃつ python-cryptoﾃつ ﾃつ ﾃつ ﾃつ ﾃつ ﾃつ ﾃつ ﾃつ ﾃつ ﾃつ ﾃつ ﾃつ ﾃつ ﾃつ ﾃつ ﾃつ ﾃつ ﾃつ ﾃつ 2.6.1-4ubuntu0.2 ﾃつ python3-cryptoﾃつ ﾃつ ﾃつ ﾃつ ﾃつ ﾃつ ﾃつ ﾃつ ﾃつ ﾃつ ﾃつ ﾃつ ﾃつ ﾃつ ﾃつ ﾃつ ﾃつ ﾃつ 2.6.1-4ubuntu0.2 In general, a standard system update will make all the necessary changes. References: ﾃつ http://www.ubuntu.com/usn/usn-3199-2 ﾃつ http://www.ubuntu.com/usn/usn-3199-1 ﾃつ CVE-2013-7459 Package Information: ﾃつ https://launchpad.net/ubuntu/+source/python-crypto/2.6.1-6ubuntu0.16.10.3 ﾃつ https://launchpad.net/ubuntu/+source/python-crypto/2.6.1-6ubuntu0.16.04.2 ﾃつ https://launchpad.net/ubuntu/+source/python-crypto/2.6.1-4ubuntu0.2 |
Original Source
| Url : http://www.ubuntu.com/usn/USN-3199-2 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-119 | Failure to Constrain Operations within the Bounds of a Memory Buffer |
CPE : Common Platform Enumeration
Nessusﾂｮ Vulnerability Scanner
| Date | Description |
|---|---|
| 2018-08-17 | Name : The remote PhotonOS host is missing multiple security updates. File : PhotonOS_PHSA-2017-0026.nasl - Type : ACT_GATHER_INFO |
| 2018-06-28 | Name : The remote EulerOS host is missing a security update. File : EulerOS_SA-2018-1168.nasl - Type : ACT_GATHER_INFO |
| 2017-08-29 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-3199-3.nasl - Type : ACT_GATHER_INFO |
| 2017-07-06 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2017-1744-1.nasl - Type : ACT_GATHER_INFO |
| 2017-03-07 | Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2017-801.nasl - Type : ACT_GATHER_INFO |
| 2017-02-21 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201702-14.nasl - Type : ACT_GATHER_INFO |
| 2017-02-21 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-3199-2.nasl - Type : ACT_GATHER_INFO |
| 2017-02-17 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-3199-1.nasl - Type : ACT_GATHER_INFO |
| 2017-01-31 | Name : The remote Fedora host is missing a security update. File : fedora_2017-08207fe48b.nasl - Type : ACT_GATHER_INFO |
| 2017-01-31 | Name : The remote Fedora host is missing a security update. File : fedora_2017-7c569d396b.nasl - Type : ACT_GATHER_INFO |
| 2017-01-17 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2017-86.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2017-02-23 21:25:53 |
|
| 2017-02-22 13:21:09 |
|
| 2017-02-17 21:24:12 |
|
