CVE-2023-52323

PyCryptodome and pycryptodomex before 3.19.1 allow side-channel leakage for OAEP decryption, exploitable for a Manger attack.

PyCryptodome is a self-contained Python package of low-level cryptographic primitives. It supports Python 2.6 and 2.7, Python 3.4 and newer, and PyPy. You can install it with:: pip install pycryptodome All modules are installed under the Crypto package. Check the pycryptodomex_ project for the equivalent library that works under the Cryptodome package. PyCryptodome is a fork of PyCrypto. It brings several enhancements with respect to the last official version of PyCrypto (2.6.1), for instance: * Authenticated encryption modes (GCM, CCM, EAX, SIV, OCB) * Accelerated AES on Intel platforms via AES-NI * First class support for PyPy * Elliptic curves cryptography (NIST P-256, P-384 and P-521 curves only) * Better and more compact API (nonce and iv attributes for ciphers, automatic generation of random nonces and IVs, simplified CTR cipher mode, and more) * SHA-3 (including SHAKE XOFs) and BLAKE2 hash algorithms * Salsa20 and ChaCha20 stream ciphers * scrypt and HKDF * Deterministic (EC)DSA * Password-protected PKCS#8 key containers * Shamir's Secret Sharing scheme * Random numbers get sourced directly from the OS (and not from a CSPRNG in userspace) * Simplified install process, including better support for Windows * Cleaner RSA and DSA key generation (largely based on FIPS 186-4) * Major clean ups and simplification of the code base PyCryptodome is not a wrapper to a separate C library like OpenSSL. To the largest possible extent, algorithms are implemented in pure Python. Only the pieces that are extremely critical to performance (e.g. block ciphers) are implemented as C extensions. For more information, see the homepage. All the code can be downloaded from GitHub.

Security Fix(es):

PyCryptodome and pycryptodomex before 3.19.1 allow side-channel leakage for OAEP decryption, exploitable for a Manger attack.(CVE-2023-52323)

PyCryptodome is a self-contained Python package of low-level cryptographic primitives.

Security Fix(es):

PyCryptodome and pycryptodomex before 3.19.1 allow side-channel leakage for OAEP decryption, exploitable for a Manger attack.(CVE-2023-52323)

A collection of executables to handle isolation ("fencing") of possibly misbehaving hosts by the means of remote power management, blocking network, storage, or similar. They operate through a unified interface (calling conventions) devised for the original Red Hat clustering solution.

Security Fix(es):

PyCryptodome and pycryptodomex before 3.19.1 allow side-channel leakage for OAEP decryption, exploitable for a Manger attack.(CVE-2023-52323)

A collection of executables to handle isolation ("fencing") of possibly misbehaving hosts by the means of remote power management, blocking network, storage, or similar. They operate through a unified interface (calling conventions) devised for the original Red Hat clustering solution.

Security Fix(es):

PyCryptodome and pycryptodomex before 3.19.1 allow side-channel leakage for OAEP decryption, exploitable for a Manger attack.(CVE-2023-52323)

A collection of executables to handle isolation ("fencing") of possibly misbehaving hosts by the means of remote power management, blocking network, storage, or similar. They operate through a unified interface (calling conventions) devised for the original Red Hat clustering solution.

Security Fix(es):

PyCryptodome and pycryptodomex before 3.19.1 allow side-channel leakage for OAEP decryption, exploitable for a Manger attack.(CVE-2023-52323)

A collection of executables to handle isolation ("fencing") of possibly misbehaving hosts by the means of remote power management, blocking network, storage, or similar. They operate through a unified interface (calling conventions) devised for the original Red Hat clustering solution.

Security Fix(es):

PyCryptodome and pycryptodomex before 3.19.1 allow side-channel leakage for OAEP decryption, exploitable for a Manger attack.(CVE-2023-52323)

PyCryptodome and pycryptodomex before 3.19.1 allow side-channel leakage for OAEP decryption, exploitable for a Manger attack.

PyCryptodome and pycryptodomex before 3.19.1 allow side-channel leakage for OAEP decryption, exploitable for a Manger attack.

The resource-agents packages provide the Pacemaker and RGManager service managers with a set of scripts. These scripts interface with several services to allow operating in a high-availability (HA) environment.

Security Fix(es):

• urllib3: Request body not stripped after redirect from 303 status changes request method to GET (CVE-2023-45803)

• pycryptodome: side-channel leakage for OAEP decryption in PyCryptodome and pycryptodomex (CVE-2023-52323)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.10 Release Notes linked from the References section.

PyCryptodome and pycryptodomex before 3.19.1 allow side-channel leakage for OAEP decryption, exploitable for a Manger attack.

The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.

Security Fix(es):

• urllib3: Request body not stripped after redirect from 303 status changes request method to GET (CVE-2023-45803)
• pycryptodome: side-channel leakage for OAEP decryption in PyCryptodome and pycryptodomex (CVE-2023-52323)
• jinja2: HTML attribute injection when passing user input as keys to xmlattr filter (CVE-2024-22195)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

The resource-agents packages provide the Pacemaker and RGManager service managers with a set of scripts. These scripts interface with several services to allow operating in a high-availability (HA) environment.

Security Fix(es):

• urllib3: Request body not stripped after redirect from 303 status changes request method to GET (CVE-2023-45803)
• pycryptodome: side-channel leakage for OAEP decryption in PyCryptodome and pycryptodomex (CVE-2023-52323)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.

Security Fix(es):

• urllib3: Request body not stripped after redirect from 303 status changes request method to GET (CVE-2023-45803)
• pycryptodome: side-channel leakage for OAEP decryption in PyCryptodome and pycryptodomex (CVE-2023-52323)
• jinja2: HTML attribute injection when passing user input as keys to xmlattr filter (CVE-2024-22195)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

These are all security issues fixed in the python310-pycryptodome-3.19.1-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python310-pycryptodomex-3.19.1-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-pycryptodome-3.23.0-1.6 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-pycryptodomex-3.23.0-1.6 package on the GA media of openSUSE Tumbleweed.

The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.

Security Fix(es):

• urllib3: Request body not stripped after redirect from 303 status changes request method to GET (CVE-2023-45803)

• pycryptodome: side-channel leakage for OAEP decryption in PyCryptodome and pycryptodomex (CVE-2023-52323)

• jinja2: HTML attribute injection when passing user input as keys to xmlattr filter (CVE-2024-22195)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.10 Release Notes linked from the References section.

This update for python-aliyun-python-sdk, python-aliyun-python-sdk-aas, python-aliyun-python-sdk-acm, python-aliyun-python-sdk-acms-open, python-aliyun-python-sdk-actiontrail, python-aliyun-python-sdk-adb, python-aliyun-python-sdk-adcp, python-aliyun-python-sdk-address-purification, python-aliyun-python-sdk-aegis, python-aliyun-python-sdk-afs, python-aliyun-python-sdk-aigen, python-aliyun-python-sdk-aimiaobi, python-aliyun-python-sdk-airec, python-aliyun-python-sdk-airticketopen, python-aliyun-python-sdk-alb, python-aliyun-python-sdk-alidns, python-aliyun-python-sdk-aligreen-console, python-aliyun-python-sdk-alikafka, python-aliyun-python-sdk-alimt, python-aliyun-python-sdk-alinlp, python-aliyun-python-sdk-aliyuncvc, python-aliyun-python-sdk-amptest, python-aliyun-python-sdk-amqp-open, python-aliyun-python-sdk-antiddos-public, python-aliyun-python-sdk-apds fixes the following issues:

Changes in python-aliyun-python-sdk:

• Switch package to modern Python Stack on SLE-15

  • Use Python 3.11 on SLE-15 by default
  • Add Obsoletes for old python3 package on SLE-15
  • Drop support for older Python versions

• Add new Aliyun SDK component packages to Requires

Changes in python-aliyun-python-sdk-aas:

• Switch package to modern Python Stack on SLE-15

  • Use Python 3.11 on SLE-15 by default
  • Add Obsoletes for old python3 package on SLE-15
  • Drop support for older Python versions

• Switch build system from setuptools to pyproject.toml

  • Add python-pip and python-wheel to BuildRequires
  • Replace %python_build with %pyproject_wheel
  • Replace %python_install with %pyproject_install

• Limit Python files matched in %files section

• Do not build for Python 2 distros 15 and higher

• Add ChangeLog.txt from upstream git

• Add python-cryptography to BuildRequires

• Drop python-devel from BuildRequires

• Drop obsolete Group field

Changes in python-aliyun-python-sdk-acm:

• Switch package to modern Python Stack on SLE-15
  • Use Python 3.11 on SLE-15 by default
  • Add Obsoletes for old python3 package on SLE-15
  • Drop support for older Python versions
• Switch build system from setuptools to pyproject.toml
  • Add python-pip and python-wheel to BuildRequires
  • Replace %python_build with %pyproject_wheel
  • Replace %python_install with %pyproject_install
• Limit Python files matched in %files section

Changes in python-aliyun-python-sdk-acms-open:

• Switch package to modern Python Stack on SLE-15
  • Use Python 3.11 on SLE-15 by default
  • Add Obsoletes for old python3 package on SLE-15
  • Drop support for older Python versions
• Switch build system from setuptools to pyproject.toml
  • Add python-pip and python-wheel to BuildRequires
  • Replace %python_build with %pyproject_wheel
  • Replace %python_install with %pyproject_install
• Limit Python files matched in %files section

Changes in python-aliyun-python-sdk-actiontrail:

• Switch package to modern Python Stack on SLE-15

  • Use Python 3.11 on SLE-15 by default
  • Add Obsoletes for old python3 package on SLE-15
  • Drop support for older Python versions

• Switch build system from setuptools to pyproject.toml

  • Add python-pip and python-wheel to BuildRequires
  • Replace %python_build with %pyproject_wheel
  • Replace %python_install with %pyproject_install

• Limit Python files matched in %files section

• New upstream release

  • Version 2.2.0
  • Version 2.0.4
  • For detailed information about changes see the ChangeLog.txt file provided with this package

Changes in python-aliyun-python-sdk-adb:

• Switch package to modern Python Stack on SLE-15

  • Use Python 3.11 on SLE-15 by default
  • Add Obsoletes for old python3 package on SLE-15
  • Drop support for older Python versions

• Switch build system from setuptools to pyproject.toml

  • Add python-pip and python-wheel to BuildRequires
  • Replace %python_build with %pyproject_wheel
  • Replace %python_install with %pyproject_install

• Limit Python files matched in %files section

• New upstream release +…

This update for python-aliyun-python-sdk, python-aliyun-python-sdk-aas, python-aliyun-python-sdk-acm, python-aliyun-python-sdk-acms-open, python-aliyun-python-sdk-actiontrail, python-aliyun-python-sdk-adb, python-aliyun-python-sdk-adcp, python-aliyun-python-sdk-address-purification, python-aliyun-python-sdk-aegis, python-aliyun-python-sdk-afs, python-aliyun-python-sdk-aigen, python-aliyun-python-sdk-aimiaobi, python-aliyun-python-sdk-airec, python-aliyun-python-sdk-airticketopen, python-aliyun-python-sdk-alb, python-aliyun-python-sdk-alidns, python-aliyun-python-sdk-aligreen-console, python-aliyun-python-sdk-alikafka, python-aliyun-python-sdk-alimt, python-aliyun-python-sdk-alinlp, python-aliyun-python-sdk-aliyuncvc, python-aliyun-python-sdk-amptest, python-aliyun-python-sdk-amqp-open, python-aliyun-python-sdk-antiddos-public, python-aliyun-python-sdk-apds fixes the following issues:

Changes in python-aliyun-python-sdk:

• Switch package to modern Python Stack on SLE-15

  • Use Python 3.11 on SLE-15 by default
  • Add Obsoletes for old python3 package on SLE-15
  • Drop support for older Python versions

• Add new Aliyun SDK component packages to Requires

Changes in python-aliyun-python-sdk-aas:

• Switch package to modern Python Stack on SLE-15

  • Use Python 3.11 on SLE-15 by default
  • Add Obsoletes for old python3 package on SLE-15
  • Drop support for older Python versions

• Switch build system from setuptools to pyproject.toml

  • Add python-pip and python-wheel to BuildRequires
  • Replace %python_build with %pyproject_wheel
  • Replace %python_install with %pyproject_install

• Limit Python files matched in %files section

• Do not build for Python 2 distros 15 and higher

• Add ChangeLog.txt from upstream git

• Add python-cryptography to BuildRequires

• Drop python-devel from BuildRequires

• Drop obsolete Group field

Changes in python-aliyun-python-sdk-acm:

• Switch package to modern Python Stack on SLE-15
  • Use Python 3.11 on SLE-15 by default
  • Add Obsoletes for old python3 package on SLE-15
  • Drop support for older Python versions
• Switch build system from setuptools to pyproject.toml
  • Add python-pip and python-wheel to BuildRequires
  • Replace %python_build with %pyproject_wheel
  • Replace %python_install with %pyproject_install
• Limit Python files matched in %files section

Changes in python-aliyun-python-sdk-acms-open:

• Switch package to modern Python Stack on SLE-15
  • Use Python 3.11 on SLE-15 by default
  • Add Obsoletes for old python3 package on SLE-15
  • Drop support for older Python versions
• Switch build system from setuptools to pyproject.toml
  • Add python-pip and python-wheel to BuildRequires
  • Replace %python_build with %pyproject_wheel
  • Replace %python_install with %pyproject_install
• Limit Python files matched in %files section

Changes in python-aliyun-python-sdk-actiontrail:

• Switch package to modern Python Stack on SLE-15

  • Use Python 3.11 on SLE-15 by default
  • Add Obsoletes for old python3 package on SLE-15
  • Drop support for older Python versions

• Switch build system from setuptools to pyproject.toml

  • Add python-pip and python-wheel to BuildRequires
  • Replace %python_build with %pyproject_wheel
  • Replace %python_install with %pyproject_install

• Limit Python files matched in %files section

• New upstream release

  • Version 2.2.0
  • Version 2.0.4
  • For detailed information about changes see the ChangeLog.txt file provided with this package

Changes in python-aliyun-python-sdk-adb:

• Switch package to modern Python Stack on SLE-15

  • Use Python 3.11 on SLE-15 by default
  • Add Obsoletes for old python3 package on SLE-15
  • Drop support for older Python versions

• Switch build system from setuptools to pyproject.toml

  • Add python-pip and python-wheel to BuildRequires
  • Replace %python_build with %pyproject_wheel
  • Replace %python_install with %pyproject_install

• Limit Python files matched in %files section

• New upstream release +…

This update for python-pycryptodomex fixes the following issues:

• CVE-2023-52323: Fixed a side-channel in the OAEP decryption, exploitable by a Manger attack (bsc#1218564).

This update for python-pycryptodome fixes the following issues:

• CVE-2023-52323: Fixed side-channel leakage in RSA decryption by using constant-time (faster) padding decoding for OAEP (bsc#1218564).

This update for python-pycryptodome fixes the following issues:

• CVE-2023-52323: Fixed side-channel leakage in RSA decryption by using constant-time (faster) padding decoding for OAEP (bsc#1218564).

It was discovered that PyCryptodome had a timing side-channel when performing OAEP decryption. A remote attacker could possibly use this issue to recover sensitive information.