Bug 1371902 - Require python-jwcrypto with fix for CVE-2016-6298
Summary: Require python-jwcrypto with fix for CVE-2016-6298
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: custodia
Version: 7.4
Hardware: Unspecified
OS: Unspecified
unspecified
urgent
Target Milestone: rc
: ---
Assignee: Christian Heimes
QA Contact: Namita Soman
URL:
Whiteboard:
Depends On: 1371901
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-08-31 12:03 UTC by Christian Heimes
Modified: 2016-11-04 02:48 UTC (History)
8 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of: 1371901
Environment:
Last Closed: 2016-11-04 02:48:26 UTC
Target Upstream Version:

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Bugzilla 1371800 0 low CLOSED CVE-2016-6298 python-jwcrypto: jwcrypto: million messages attack vulnerability [fedora-all] 2021-02-22 00:41:40 UTC
Red Hat Product Errata RHEA-2016:2287 0 normal SHIPPED_LIVE new packages: custodia 2016-11-03 13:37:04 UTC

Description Christian Heimes 2016-08-31 12:03:21 UTC 
+++ This bug was initially created as a clone of Bug #1371901 +++

Description of problem:

A security in python-jwcrypto was found. The jwcrypto implementation of the RSA1_5 algorithm is vulnerable to the Million Message Attack described in RFC 3128. RSA with PKCS1v1.5 is used by Custodia and ipapython.secrets


Version-Release number of selected component (if applicable):
<= 0.3


Additional info:
Upstream bug report: https://github.com/latchset/jwcrypto/pull/66
Upstream fix: https://github.com/latchset/jwcrypto/pull/66
Comment 2 Martin Kosek 2016-09-05 15:25:54 UTC 
The patch is available upstream
https://github.com/latchset/custodia/pull/70
Comment 3 Christian Heimes 2016-09-05 15:30:44 UTC 
Patch for FreeIPA: https://github.com/freeipa/freeipa/pull/56
Comment 7 Namita Soman 2016-09-16 17:57:47 UTC 
# cat /etc/redhat-release 
Red Hat Enterprise Linux Server release 7.3 Beta (Maipo)

# rpm -qi python-jwcrypto
Name        : python-jwcrypto
Version     : 0.2.1
Release     : 1.el7
Architecture: noarch
Install Date: Mon 12 Sep 2016 05:30:24 PM IST
Group       : Unspecified
Size        : 166061
License     : LGPLv3+
Signature   : RSA/SHA256, Thu 28 Jul 2016 12:42:57 PM IST, Key ID 938a80caf21541eb
Source RPM  : python-jwcrypto-0.2.1-1.el7.src.rpm
Build Date  : Sat 02 Apr 2016 05:24:19 PM IST
Build Host  : ppc-021.build.eng.bos.redhat.com
Relocations : (not relocatable)
Packager    : Red Hat, Inc. <http://bugzilla.redhat.com/bugzilla>
Vendor      : Red Hat, Inc.
URL         : https://github.com/simo5/jwcrypto
Summary     : Implements JWK,JWS,JWE specifications using python-cryptography
Description :
Implements JWK,JWS,JWE specifications using python-cryptography
Comment 9 errata-xmlrpc 2016-11-04 02:48:26 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHEA-2016-2287.html
Note You need to log in before you can comment on or make changes to this bug.