openSUSE alert openSUSE-SU-2019:1104-1 (python-cryptography, python-pyOpenSSL)

From:
             
 
opensuse-security@opensuse.org 
To:
             
 
opensuse-updates@opensuse.org 
Subject:
             
 
openSUSE-SU-2019:1104-1: important: Security update for python-cryptography, python-pyOpenSSL 
Date:
             
 
Tue,  2 Apr 2019 18:26:19 +0200 (CEST)
Message-ID:
             
 
<20190402162619.5A124F7BB@maintenance.suse.de>
   openSUSE Security Update: Security update for python-cryptography, python-pyOpenSSL
______________________________________________________________________________

Announcement ID:    openSUSE-SU-2019:1104-1
Rating:             important
References:         #1021578 #1052927 #1111634 #1111635 #1119077 
                    
Cross-References:   CVE-2018-1000807 CVE-2018-1000808
Affected Products:
                    openSUSE Leap 42.3
______________________________________________________________________________

   An update that solves two vulnerabilities and has three
   fixes is now available.

Description:

   This update for python-cryptography, python-pyOpenSSL fixes the following
   issues:

   Security issues fixed:

   - CVE-2018-1000808: A memory leak due to missing reference checking in
     PKCS#12 store handling was fixed (bsc#1111634)
   - CVE-2018-1000807: A use-after-free in X509 object handling was fixed
     (bsc#1111635)

   This update also contains the following tracked bug fixes:

   - avoid bad interaction with python-cryptography package. (bsc#1021578)
   - Avoid regression accessesing non-existing attribute _from_raw_x509_ptr
     in object X509 (bsc#1119077)
   - Add python-setuptools as a requirement. (bsc#1052927)

   This update was imported from the SUSE:SLE-12-SP2:Update update project.


Patch Instructions:

   To install this openSUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - openSUSE Leap 42.3:

      zypper in -t patch openSUSE-2019-1104=1



Package List:

   - openSUSE Leap 42.3 (noarch):

      python-pyOpenSSL-16.0.0-5.8.2
      python-pyOpenSSL-doc-16.0.0-5.8.2
      python3-pyOpenSSL-16.0.0-5.8.2
      python3-pyOpenSSL-doc-16.0.0-5.8.2

   - openSUSE Leap 42.3 (x86_64):

      python-cryptography-1.3.1-5.3.1
      python-cryptography-debuginfo-1.3.1-5.3.1
      python-cryptography-debugsource-1.3.1-5.3.1
      python3-cryptography-1.3.1-5.3.1
      python3-cryptography-debuginfo-1.3.1-5.3.1


References:

   https://www.suse.com/security/cve/CVE-2018-1000807.html
   https://www.suse.com/security/cve/CVE-2018-1000808.html
   https://bugzilla.suse.com/1021578
   https://bugzilla.suse.com/1052927
   https://bugzilla.suse.com/1111634
   https://bugzilla.suse.com/1111635
   https://bugzilla.suse.com/1119077