{"schema_version":"1.7.2","id":"OESA-2024-1046","modified":"2024-01-12T11:06:44Z","published":"2024-01-12T11:06:44Z","upstream":["CVE-2023-52323"],"summary":"python-pycryptodome security update","details":"PyCryptodome is a self-contained Python package of low-level cryptographic primitives. It supports Python 2.6 and 2.7, Python 3.4 and newer, and PyPy. You can install it with::     pip install pycryptodome All modules are installed under the ``Crypto`` package. Check the pycryptodomex_ project for the equivalent library that works under the ``Cryptodome`` package. PyCryptodome is a fork of PyCrypto. It brings several enhancements with respect to the last official version of PyCrypto (2.6.1), for instance: * Authenticated encryption modes (GCM, CCM, EAX, SIV, OCB) * Accelerated AES on Intel platforms via AES-NI * First class support for PyPy * Elliptic curves cryptography (NIST P-256, P-384 and P-521 curves only) * Better and more compact API (`nonce` and `iv` attributes for ciphers,   automatic generation of random nonces and IVs, simplified CTR cipher mode,   and more) * SHA-3 (including SHAKE XOFs) and BLAKE2 hash algorithms * Salsa20 and ChaCha20 stream ciphers * scrypt and HKDF * Deterministic (EC)DSA * Password-protected PKCS#8 key containers * Shamir\u0026apos;s Secret Sharing scheme * Random numbers get sourced directly from the OS (and not from a CSPRNG in userspace) * Simplified install process, including better support for Windows * Cleaner RSA and DSA key generation (largely based on FIPS 186-4) * Major clean ups and simplification of the code base PyCryptodome is not a wrapper to a separate C library like *OpenSSL*. To the largest possible extent, algorithms are implemented in pure Python. Only the pieces that are extremely critical to performance (e.g. block ciphers) are implemented as C extensions. For more information, see the `homepage`_. All the code can be downloaded from `GitHub`_.\r\n\r\nSecurity Fix(es):\r\n\r\nPyCryptodome and pycryptodomex before 3.19.1 allow side-channel leakage for OAEP decryption, exploitable for a Manger attack.(CVE-2023-52323)","affected":[{"package":{"ecosystem":"openEuler:20.03-LTS-SP1","name":"python-pycryptodome","purl":"pkg:rpm/openEuler/python-pycryptodome\u0026distro=openEuler-20.03-LTS-SP1"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.19.1-1.oe1"}]}],"ecosystem_specific":{"aarch64":["python-pycryptodome-debuginfo-3.19.1-1.oe1.aarch64.rpm","python3-pycryptodome-3.19.1-1.oe1.aarch64.rpm","python-pycryptodome-debugsource-3.19.1-1.oe1.aarch64.rpm","python2-pycryptodome-3.19.1-1.oe1.aarch64.rpm"],"src":["python-pycryptodome-3.19.1-1.oe1.src.rpm"],"x86_64":["python-pycryptodome-debugsource-3.19.1-1.oe1.x86_64.rpm","python-pycryptodome-debuginfo-3.19.1-1.oe1.x86_64.rpm","python3-pycryptodome-3.19.1-1.oe1.x86_64.rpm","python2-pycryptodome-3.19.1-1.oe1.x86_64.rpm"]}},{"package":{"ecosystem":"openEuler:20.03-LTS-SP4","name":"python-pycryptodome","purl":"pkg:rpm/openEuler/python-pycryptodome\u0026distro=openEuler-20.03-LTS-SP4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.19.1-1.oe2003sp4"}]}],"ecosystem_specific":{"aarch64":["python2-pycryptodome-3.19.1-1.oe2003sp4.aarch64.rpm","python-pycryptodome-debugsource-3.19.1-1.oe2003sp4.aarch64.rpm","python-pycryptodome-debuginfo-3.19.1-1.oe2003sp4.aarch64.rpm","python3-pycryptodome-3.19.1-1.oe2003sp4.aarch64.rpm"],"src":["python-pycryptodome-3.19.1-1.oe2003sp4.src.rpm"],"x86_64":["python2-pycryptodome-3.19.1-1.oe2003sp4.x86_64.rpm","python3-pycryptodome-3.19.1-1.oe2003sp4.x86_64.rpm","python-pycryptodome-debugsource-3.19.1-1.oe2003sp4.x86_64.rpm","python-pycryptodome-debuginfo-3.19.1-1.oe2003sp4.x86_64.rpm"]}},{"package":{"ecosystem":"openEuler:22.03-LTS","name":"python-pycryptodome","purl":"pkg:rpm/openEuler/python-pycryptodome\u0026distro=openEuler-22.03-LTS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.19.1-1.oe2203sp3"}]}],"ecosystem_specific":{"aarch64":["python-pycryptodome-debugsource-3.19.1-1.oe2203.aarch64.rpm","python-pycryptodome-debuginfo-3.19.1-1.oe2203.aarch64.rpm","python3-pycryptodome-3.19.1-1.oe2203.aarch64.rpm","python-pycryptodome-debuginfo-3.19.1-1.oe2203sp1.aarch64.rpm","python3-pycryptodome-3.19.1-1.oe2203sp1.aarch64.rpm","python-pycryptodome-debugsource-3.19.1-1.oe2203sp1.aarch64.rpm","python-pycryptodome-debuginfo-3.19.1-1.oe2203sp2.aarch64.rpm","python-pycryptodome-debugsource-3.19.1-1.oe2203sp2.aarch64.rpm","python3-pycryptodome-3.19.1-1.oe2203sp2.aarch64.rpm","python3-pycryptodome-3.19.1-1.oe2203sp3.aarch64.rpm","python-pycryptodome-debuginfo-3.19.1-1.oe2203sp3.aarch64.rpm","python-pycryptodome-debugsource-3.19.1-1.oe2203sp3.aarch64.rpm"],"src":["python-pycryptodome-3.19.1-1.oe2203.src.rpm","python-pycryptodome-3.19.1-1.oe2203sp1.src.rpm","python-pycryptodome-3.19.1-1.oe2203sp2.src.rpm","python-pycryptodome-3.19.1-1.oe2203sp3.src.rpm"],"x86_64":["python-pycryptodome-debuginfo-3.19.1-1.oe2203.x86_64.rpm","python3-pycryptodome-3.19.1-1.oe2203.x86_64.rpm","python-pycryptodome-debugsource-3.19.1-1.oe2203.x86_64.rpm","python3-pycryptodome-3.19.1-1.oe2203sp1.x86_64.rpm","python-pycryptodome-debuginfo-3.19.1-1.oe2203sp1.x86_64.rpm","python-pycryptodome-debugsource-3.19.1-1.oe2203sp1.x86_64.rpm","python3-pycryptodome-3.19.1-1.oe2203sp2.x86_64.rpm","python-pycryptodome-debuginfo-3.19.1-1.oe2203sp2.x86_64.rpm","python-pycryptodome-debugsource-3.19.1-1.oe2203sp2.x86_64.rpm","python3-pycryptodome-3.19.1-1.oe2203sp3.x86_64.rpm","python-pycryptodome-debuginfo-3.19.1-1.oe2203sp3.x86_64.rpm","python-pycryptodome-debugsource-3.19.1-1.oe2203sp3.x86_64.rpm"]}},{"package":{"ecosystem":"openEuler:22.03-LTS-SP1","name":"python-pycryptodome","purl":"pkg:rpm/openEuler/python-pycryptodome\u0026distro=openEuler-22.03-LTS-SP1"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.19.1-1.oe2203sp1"}]}],"ecosystem_specific":{"aarch64":["python-pycryptodome-debuginfo-3.19.1-1.oe2203sp1.aarch64.rpm","python3-pycryptodome-3.19.1-1.oe2203sp1.aarch64.rpm","python-pycryptodome-debugsource-3.19.1-1.oe2203sp1.aarch64.rpm"],"src":["python-pycryptodome-3.19.1-1.oe2203sp1.src.rpm"],"x86_64":["python3-pycryptodome-3.19.1-1.oe2203sp1.x86_64.rpm","python-pycryptodome-debuginfo-3.19.1-1.oe2203sp1.x86_64.rpm","python-pycryptodome-debugsource-3.19.1-1.oe2203sp1.x86_64.rpm"]}},{"package":{"ecosystem":"openEuler:22.03-LTS-SP2","name":"python-pycryptodome","purl":"pkg:rpm/openEuler/python-pycryptodome\u0026distro=openEuler-22.03-LTS-SP2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.19.1-1.oe2203sp2"}]}],"ecosystem_specific":{"aarch64":["python-pycryptodome-debuginfo-3.19.1-1.oe2203sp2.aarch64.rpm","python-pycryptodome-debugsource-3.19.1-1.oe2203sp2.aarch64.rpm","python3-pycryptodome-3.19.1-1.oe2203sp2.aarch64.rpm"],"src":["python-pycryptodome-3.19.1-1.oe2203sp2.src.rpm"],"x86_64":["python3-pycryptodome-3.19.1-1.oe2203sp2.x86_64.rpm","python-pycryptodome-debuginfo-3.19.1-1.oe2203sp2.x86_64.rpm","python-pycryptodome-debugsource-3.19.1-1.oe2203sp2.x86_64.rpm"]}},{"package":{"ecosystem":"openEuler:22.03-LTS-SP3","name":"python-pycryptodome","purl":"pkg:rpm/openEuler/python-pycryptodome\u0026distro=openEuler-22.03-LTS-SP3"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.19.1-1.oe2203sp3"}]}],"ecosystem_specific":{"aarch64":["python3-pycryptodome-3.19.1-1.oe2203sp3.aarch64.rpm","python-pycryptodome-debuginfo-3.19.1-1.oe2203sp3.aarch64.rpm","python-pycryptodome-debugsource-3.19.1-1.oe2203sp3.aarch64.rpm"],"src":["python-pycryptodome-3.19.1-1.oe2203sp3.src.rpm"],"x86_64":["python3-pycryptodome-3.19.1-1.oe2203sp3.x86_64.rpm","python-pycryptodome-debuginfo-3.19.1-1.oe2203sp3.x86_64.rpm","python-pycryptodome-debugsource-3.19.1-1.oe2203sp3.x86_64.rpm"]}}],"references":[{"type":"ADVISORY","url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1046"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52323"}],"database_specific":{"severity":"Medium"}}