Hide Forgot
Description of problem: A security in python-jwcrypto was found. The jwcrypto implementation of the RSA1_5 algorithm is vulnerable to the Million Message Attack described in RFC 3128. RSA with PKCS1v1.5 is used by Custodia and ipapython.secrets Version-Release number of selected component (if applicable): <= 0.3 Additional info: Upstream bug report: https://github.com/latchset/jwcrypto/pull/66 Upstream fix: https://github.com/latchset/jwcrypto/pull/66
Upstream ticket: https://fedorahosted.org/freeipa/ticket/6278
Fixed upstream master: https://fedorahosted.org/freeipa/changeset/4ae4d0d6909e99892442a170288f0eee9610d1c2 ipa-4-4: https://fedorahosted.org/freeipa/changeset/71e7cb124d021f976eebb6e99fc012becf94a9b6 ipa-4-3: https://fedorahosted.org/freeipa/changeset/2e27b7077d280447dbf526b567566101d4c800c7
We need this fixed ASAP because it opens a door for an attack. The change is simple and minor. Patch is provided.
Changing BZ description to match what was fixed in code. We started using safer padding method.
Verified SanityOnly.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2016-2404.html