Bug 1371902 - Require python-jwcrypto with fix for CVE-2016-6298
Summary: Require python-jwcrypto with fix for CVE-2016-6298
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: custodia
Version: 7.4
Hardware: Unspecified
OS: Unspecified
unspecified
urgent
Target Milestone: rc
: ---
Assignee: Christian Heimes
QA Contact: Namita Soman
URL:
Whiteboard:
Keywords:
Depends On: 1371901
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-08-31 12:03 UTC by Christian Heimes
Modified: 2016-11-04 02:48 UTC (History)
8 users (show)

(edit)
Clone Of: 1371901
(edit)
Last Closed: 2016-11-04 02:48:26 UTC


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHEA-2016:2287 normal SHIPPED_LIVE new packages: custodia 2016-11-03 13:37:04 UTC
Red Hat Bugzilla 1371800 None None None 2016-08-31 12:03 UTC

Description Christian Heimes 2016-08-31 12:03:21 UTC
+++ This bug was initially created as a clone of Bug #1371901 +++

Description of problem:

A security in python-jwcrypto was found. The jwcrypto implementation of the RSA1_5 algorithm is vulnerable to the Million Message Attack described in RFC 3128. RSA with PKCS1v1.5 is used by Custodia and ipapython.secrets


Version-Release number of selected component (if applicable):
<= 0.3


Additional info:
Upstream bug report: https://github.com/latchset/jwcrypto/pull/66
Upstream fix: https://github.com/latchset/jwcrypto/pull/66

Comment 2 Martin Kosek 2016-09-05 15:25:54 UTC
The patch is available upstream
https://github.com/latchset/custodia/pull/70

Comment 3 Christian Heimes 2016-09-05 15:30:44 UTC
Patch for FreeIPA: https://github.com/freeipa/freeipa/pull/56

Comment 7 Namita Soman 2016-09-16 17:57:47 UTC
# cat /etc/redhat-release 
Red Hat Enterprise Linux Server release 7.3 Beta (Maipo)

# rpm -qi python-jwcrypto
Name        : python-jwcrypto
Version     : 0.2.1
Release     : 1.el7
Architecture: noarch
Install Date: Mon 12 Sep 2016 05:30:24 PM IST
Group       : Unspecified
Size        : 166061
License     : LGPLv3+
Signature   : RSA/SHA256, Thu 28 Jul 2016 12:42:57 PM IST, Key ID 938a80caf21541eb
Source RPM  : python-jwcrypto-0.2.1-1.el7.src.rpm
Build Date  : Sat 02 Apr 2016 05:24:19 PM IST
Build Host  : ppc-021.build.eng.bos.redhat.com
Relocations : (not relocatable)
Packager    : Red Hat, Inc. <http://bugzilla.redhat.com/bugzilla>
Vendor      : Red Hat, Inc.
URL         : https://github.com/simo5/jwcrypto
Summary     : Implements JWK,JWS,JWE specifications using python-cryptography
Description :
Implements JWK,JWS,JWE specifications using python-cryptography

Comment 9 errata-xmlrpc 2016-11-04 02:48:26 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHEA-2016-2287.html


Note You need to log in before you can comment on or make changes to this bug.