CLSA-2026-1788167137
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1788167137.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1788167137
- Upstream
- Published
- 2026-08-31T09:05:48Z
- Modified
- 2026-10-26T09:43:11Z
- Summary
- Fix CVE(s): CVE-2023-50782
- Details
-
- SECURITY UPDATE: Bleichenbacher/Marvin timing oracle in RSA PKCS#1 v1.5
decryption. Distinguishing a padding failure from a successful
decryption, by error or by plaintext length, lets an attacker with
chosen ciphertexts recover the plaintext of an intercepted message.
This is the incomplete-fix follow-up to CVE-2020-25659.
- debian/patches/CVE-2023-50782.patch: expose Cryptography_HAS_IMPLICIT_RSA_REJECTION from the linked OpenSSL headers in src/_cffi_src/openssl/rsa.py, and skip the PKCS1v15 padding-error assertion when that OpenSSL implicitly rejects invalid padding, in tests/hazmat/primitives/test_rsa.py.
- The behaviour that closes the oracle comes from OpenSSL implicit rejection (LP: #2054090); built against an OpenSSL without it the constant compiles as 0 and this package behaves as before.
- CVE-2023-50782
- Build fix: call email.utils.parseaddr with strict=False in
src/cryptography/x509/general_name.py. The ELS python2.7 and python3.6
carry CVE-2023-27043.patch, whose strict parser guards on
isinstance(addr, str); on Python 2 that is bytes, so every unicode
argument yields ('', '') and RFC822Name rejects valid addresses, which
breaks collection of the package test suite.
- debian/patches/fix-parseaddr-call.patch: same workaround the centos7els branch of this package already carries.
- SECURITY UPDATE: Bleichenbacher/Marvin timing oracle in RSA PKCS#1 v1.5
decryption. Distinguishing a padding failure from a successful
decryption, by error or by plaintext length, lets an attacker with
chosen ciphertexts recover the plaintext of an intercepted message.
This is the incomplete-fix follow-up to CVE-2020-25659.
- References
Affected packages
TuxCare:Ubuntu:18.04 / python-cryptography
Package
- Name
- python-cryptography
- Purl
- pkg:deb/tuxcare/python-cryptography?distro=ubuntu-18.04
TuxCare:Ubuntu:18.04 / python-cryptography-doc
Package
- Name
- python-cryptography-doc
- Purl
- pkg:deb/tuxcare/python-cryptography-doc?distro=ubuntu-18.04