Verwendung schwacher Verschlüsselung in python-crypto
ID: | FEDORA-2018-0c75cc72bc |
Distribution: | Fedora |
Plattformen: | Fedora 26 |
Datum: | Mi, 7. März 2018, 08:48 |
Referenzen: | http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6594 |
Applikationen: | PyCrypto |
Originalnachricht |
|
-------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2018-0c75cc72bc 2018-03-06 17:26:39.511249 -------------------------------------------------------------------------------- Name : python-crypto Product : Fedora 26 Version : 2.6.1 Release : 22.fc26 URL : http://www.pycrypto.org/ Summary : Cryptography library for Python Description : PyCrypto is a collection of both secure hash functions (such as MD5 and SHA), and various encryption algorithms (AES, DES, RSA, ElGamal, etc.). -------------------------------------------------------------------------------- Update Information: The textbook ElGamal implementation is not secure. PyCrypto and some other implementations use the wrong algorithm, which may lead to some information disclosure simply by looking at the encrypted text. For a full description, see https://github.com/dlitz/pycrypto/issues/253 This update includes a fix for this problem backported from pycryptodome. -------------------------------------------------------------------------------- References: [ 1 ] Bug #1542313 - CVE-2018-6594 python-crypto: Weak ElGamal key parameters in PublicKey/ElGamal.py allow attackers to obtain sensitive information by reading ciphertext https://bugzilla.redhat.com/show_bug.cgi?id=1542313 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade python-crypto' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list -- package-announce@lists.fedoraproject.org To unsubscribe send an email to package-announce-leave@lists.fedoraproject.org |