SB20261001140 - Ubuntu update for python-cryptography

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261001140

SB20261001140 - Ubuntu update for python-cryptography

Published: October 1, 2026

Security Bulletin ID SB20261001140
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 75% Low 25%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 vulnerabilities.


1) Error Handling (CVE-ID: CVE-2023-23931)

CWE-ID: CWE-388 - Error Handling

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an attacker to misuse Python API.

The vulnerability exists due to a soundness bug within the Cipher.update_into function, which can allow immutable objects (such as bytes) to be mutated. A malicious programmer can misuse Python API to introduce unexpected behavior into the application.


2) Information Exposure Through an Error Message (CVE-ID: CVE-2026-69247)

CWE-ID: CWE-209 - Information Exposure Through an Error Message

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to recover plaintext from PKCS#7 EnvelopedData messages.

The vulnerability exists due to generation of error message containing sensitive information and observable timing discrepancy in pkcs7_decrypt_der, pkcs7_decrypt_pem, and pkcs7_decrypt_smime when decrypting attacker-supplied EnvelopedData. A remote attacker can send crafted EnvelopedData messages and observe distinguishable errors and timing differences to recover plaintext from PKCS#7 EnvelopedData messages.

Exploitation requires a service that automatically decrypts untrusted EnvelopedData for the victim certificate and returns adaptive responses at high volume.


3) Improper Certificate Validation (CVE-ID: CVE-2026-69248)

CWE-ID: CWE-295 - Improper Certificate Validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to spoof certificate identity validation.

The vulnerability exists due to improper certificate validation in the certificate verifier when processing certificate chains with wildcard DNS subject alternative names under permitted subtrees constraints. A remote attacker can present a specially crafted certificate chain to spoof certificate identity validation.

The issue occurs when an intermediate constrained CA permits a specific DNS name such as foo.example.com, but a leaf certificate uses a broader wildcard DNS SAN such as *.example.com.


4) Resource exhaustion (CVE-ID: CVE-2026-69249)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in the certificate chain path-building logic when processing invalid certificate chains containing duplicate self-signed certificates. A remote attacker can supply a crafted certificate chain to cause a denial of service.

The issue affects availability only; certificate validation correctness is not affected.


Remediation

Install update from vendor's website.

References