USN-8776-1: python-cryptography vulnerabilities
Ubuntu patches python-cryptography flaws including a PKCS#7 timing side-channel (CVE-2026-69247) that could allow key recovery.
Ubuntu Security Notice USN-8776-1 fixes multiple vulnerabilities in python-cryptography. CVE-2026-69247 describes distinguishable PKCS#7 decryption outcomes with observable timing differences that a remote attacker could exploit to recover encryption keys; it affects Ubuntu 26.04 LTS. CVE-2023-23931, affecting only Ubuntu 18.04 LTS, involves incorrect handling of objects with immutable buffers during cipher operations, causing corrupted output, and a third issue reported by Jack Lloyd is also addressed.
- Timing side-channel in PKCS#7 decryption may leak message encryption keys (CVE-2026-69247).
- CVE-2026-69247 affects only Ubuntu 26.04 LTS.
- CVE-2023-23931 causes corrupted cipher output and affects only Ubuntu 18.04 LTS.
- Additional fix contributed by Jack Lloyd included in the notice.
- Products
- python-cryptography
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2023-23931 | cryptography is a package designed to expose cryptographic primitives and recipes to Python developers | 6.5 | 1% | PoC | |
| CVE-2026-69247 | cryptography is a package designed to expose cryptographic primitives and recipes to Python developers | 8.2 | <1% |
From the original article
It was discovered that python-cryptography incorrectly accepted objects with immutable buffers when performing certain cipher operations. This would result in corrupted output, contrary to expectations. This issue only affected Ubuntu 18.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.