USN-3138-1: python-cryptography vulnerability

Releases

• Ubuntu 16.10
• Ubuntu 16.04 ESM

Packages

• python-cryptography - Cryptography Python library

Details

Markus Döring discovered that python-cryptography incorrectly handled
certain HKDF lengths. This could result in python-cryptography returning an
empty string instead of the expected derived key.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 16.10

• python-cryptography - 1.5-2ubuntu0.1
• python3-cryptography - 1.5-2ubuntu0.1

Ubuntu 16.04

• python-cryptography - 1.2.3-1ubuntu0.1
• python3-cryptography - 1.2.3-1ubuntu0.1

In general, a standard system update will make all the necessary changes.

References

• CVE-2016-9243