Bug 2214228

Summary:	RUSTSEC-2023-0042: ouroboros < 0.16 is unsound
Product:	[Fedora] Fedora	Reporter:	Fabio Valentini <decathorpe>
Component:	python-cryptography	Assignee:	Jeremy Cline <jeremy>
Status:	CLOSED ERRATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	rawhide	CC:	cheimes, jeremy, python-packagers-sig
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Linux
Whiteboard:
Fixed In Version:	python-cryptography-41.0.3-2.fc40	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-08-14 07:21:36 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2214198

Description Fabio Valentini 2023-06-12 10:09:56 UTC

c.f. https://rustsec.org/advisories/RUSTSEC-2023-0042.html

The ouroboros crate is affected by soundness issues, which could result in invalid code being generated in future versions of Rust. The upstream project recommends to migrate to the self_cell crate:

https://github.com/joshua-maros/ouroboros/issues/88

Reproducible: Always

Comment 1 Christian Heimes 2023-06-12 12:33:49 UTC

Upstream PyCA cryptography has switched to self_cell two hours ago. The issue will be fixed with the next upstream release.

Comment 2 Fedora Update System 2023-08-14 05:41:26 UTC

FEDORA-2023-7ecaae2a18 has been submitted as an update to Fedora 40. https://bodhi.fedoraproject.org/updates/FEDORA-2023-7ecaae2a18

Comment 3 Fedora Update System 2023-08-14 07:21:36 UTC

FEDORA-2023-7ecaae2a18 has been pushed to the Fedora 40 stable repository.
If problem still persists, please make note of it in this bug report.