Security update for python-pycrypto SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2017:2350-1 Final 1 1 2017-09-05T12:41:27Z current 2017-09-05T12:41:27Z 2017-09-05T12:41:27Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for python-pycrypto This update for python-pycrypto fixes the following issues: - CVE-2013-7459: Fixed a potential heap buffer overflow in ALGnew (bsc#1017420). python-paramiko was adjusted to work together with this python-pycrypto change. (bsc#1047666) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-CAASP-ALL-2017-1457,SUSE-OpenStack-Cloud-6-2017-1457,SUSE-OpenStack-Cloud-7-2017-1457,SUSE-OpenStack-Cloud-Magnum-Orchestration-7-2017-1457,SUSE-SLE-Manager-Tools-12-2017-1457,SUSE-SLE-Module-Adv-Systems-Management-12-2017-1457,SUSE-SLE-Module-Public-Cloud-12-2017-1457,SUSE-SLE-Module-Web-Scripting-12-2017-1457,SUSE-SLE-POS-12-SP2-2017-1457,SUSE-SUSE-Manager-Proxy-3.0-2017-1457,SUSE-SUSE-Manager-Proxy-3.1-2017-1457,SUSE-SUSE-Manager-Server-3.0-2017-1457,SUSE-SUSE-Manager-Server-3.1-2017-1457,SUSE-Storage-3-2017-1457,SUSE-Storage-4-2017-1457 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2017/suse-su-20172350-1/ Link for SUSE-SU-2017:2350-1 https://lists.opensuse.org/opensuse-security-announce/2017-09/msg00011.html E-Mail link for SUSE-SU-2017:2350-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1017420 SUSE Bug 1017420 https://bugzilla.suse.com/1047666 SUSE Bug 1047666 https://www.suse.com/security/cve/CVE-2013-7459/ SUSE CVE CVE-2013-7459 page SUSE Enterprise Storage 3 SUSE Enterprise Storage 4 SUSE Linux Enterprise Module for Advanced Systems Management 12 SUSE Linux Enterprise Module for Public Cloud 12 SUSE Linux Enterprise Module for Web and Scripting 12 SUSE Linux Enterprise Point of Sale 12 SP2 SUSE Manager Proxy 3.0 SUSE Manager Proxy 3.1 SUSE Manager Server 3.0 SUSE Manager Server 3.1 SUSE Manager Tools 12 SUSE OpenStack Cloud 6 SUSE OpenStack Cloud 7 python-paramiko-1.15.2-2.3.1 python-pycrypto-2.6.1-10.3.1 python-paramiko-1.15.2-2.6.1 python-paramiko-1.15.2-2.3.1 as a component of SUSE Enterprise Storage 3 python-pycrypto-2.6.1-10.3.1 as a component of SUSE Enterprise Storage 3 python-pycrypto-2.6.1-10.3.1 as a component of SUSE Enterprise Storage 4 python-pycrypto-2.6.1-10.3.1 as a component of SUSE Linux Enterprise Module for Advanced Systems Management 12 python-paramiko-1.15.2-2.6.1 as a component of SUSE Linux Enterprise Module for Public Cloud 12 python-pycrypto-2.6.1-10.3.1 as a component of SUSE Linux Enterprise Module for Public Cloud 12 python-pycrypto-2.6.1-10.3.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 python-pycrypto-2.6.1-10.3.1 as a component of SUSE Linux Enterprise Point of Sale 12 SP2 python-pycrypto-2.6.1-10.3.1 as a component of SUSE Manager Proxy 3.0 python-pycrypto-2.6.1-10.3.1 as a component of SUSE Manager Proxy 3.1 python-pycrypto-2.6.1-10.3.1 as a component of SUSE Manager Server 3.0 python-pycrypto-2.6.1-10.3.1 as a component of SUSE Manager Server 3.1 python-pycrypto-2.6.1-10.3.1 as a component of SUSE Manager Tools 12 python-paramiko-1.15.2-2.3.1 as a component of SUSE OpenStack Cloud 6 python-pycrypto-2.6.1-10.3.1 as a component of SUSE OpenStack Cloud 6 python-pycrypto-2.6.1-10.3.1 as a component of SUSE OpenStack Cloud 7 Heap-based buffer overflow in the ALGnew function in block_templace.c in Python Cryptography Toolkit (aka pycrypto) allows remote attackers to execute arbitrary code as demonstrated by a crafted iv parameter to cryptmsg.py. CVE-2013-7459 SUSE Enterprise Storage 3:python-paramiko-1.15.2-2.3.1 SUSE Enterprise Storage 3:python-pycrypto-2.6.1-10.3.1 SUSE Enterprise Storage 4:python-pycrypto-2.6.1-10.3.1 SUSE Linux Enterprise Module for Advanced Systems Management 12:python-pycrypto-2.6.1-10.3.1 SUSE Linux Enterprise Module for Public Cloud 12:python-paramiko-1.15.2-2.6.1 SUSE Linux Enterprise Module for Public Cloud 12:python-pycrypto-2.6.1-10.3.1 SUSE Linux Enterprise Module for Web and Scripting 12:python-pycrypto-2.6.1-10.3.1 SUSE Linux Enterprise Point of Sale 12 SP2:python-pycrypto-2.6.1-10.3.1 SUSE Manager Proxy 3.0:python-pycrypto-2.6.1-10.3.1 SUSE Manager Proxy 3.1:python-pycrypto-2.6.1-10.3.1 SUSE Manager Server 3.0:python-pycrypto-2.6.1-10.3.1 SUSE Manager Server 3.1:python-pycrypto-2.6.1-10.3.1 SUSE Manager Tools 12:python-pycrypto-2.6.1-10.3.1 SUSE OpenStack Cloud 6:python-paramiko-1.15.2-2.3.1 SUSE OpenStack Cloud 6:python-pycrypto-2.6.1-10.3.1 SUSE OpenStack Cloud 7:python-pycrypto-2.6.1-10.3.1 moderate 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172350-1/ https://www.suse.com/security/cve/CVE-2013-7459.html CVE-2013-7459 https://bugzilla.suse.com/1017420 SUSE Bug 1017420 https://bugzilla.suse.com/1047666 SUSE Bug 1047666 https://bugzilla.suse.com/1087140 SUSE Bug 1087140