{"id":"CLSA-2026-1788167137","summary":"Fix CVE(s): CVE-2023-50782","details":"   * SECURITY UPDATE: Bleichenbacher/Marvin timing oracle in RSA PKCS#1 v1.5\n     decryption. Distinguishing a padding failure from a successful\n     decryption, by error or by plaintext length, lets an attacker with\n     chosen ciphertexts recover the plaintext of an intercepted message.\n     This is the incomplete-fix follow-up to CVE-2020-25659.\n     - debian/patches/CVE-2023-50782.patch: expose\n       Cryptography_HAS_IMPLICIT_RSA_REJECTION from the linked OpenSSL\n       headers in src/_cffi_src/openssl/rsa.py, and skip the PKCS1v15\n       padding-error assertion when that OpenSSL implicitly rejects invalid\n       padding, in tests/hazmat/primitives/test_rsa.py.\n     - The behaviour that closes the oracle comes from OpenSSL implicit\n       rejection (LP: #2054090); built against an OpenSSL without it the\n       constant compiles as 0 and this package behaves as before.\n     - CVE-2023-50782\n   * Build fix: call email.utils.parseaddr with strict=False in\n     src/cryptography/x509/general_name.py. The ELS python2.7 and python3.6\n     carry CVE-2023-27043.patch, whose strict parser guards on\n     isinstance(addr, str); on Python 2 that is bytes, so every unicode\n     argument yields ('', '') and RFC822Name rejects valid addresses, which\n     breaks collection of the package test suite.\n     - debian/patches/fix-parseaddr-call.patch: same workaround the\n       centos7els branch of this package already carries.","modified":"2026-10-26T09:43:11.318148228Z","published":"2026-08-31T09:05:48Z","upstream":["CVE-2020-25659","CVE-2023-27043","CVE-2023-50782"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1788167137.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-50782"}],"affected":[{"package":{"name":"python-cryptography","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/python-cryptography?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.4-1ubuntu1.4+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1788167137.json"}},{"package":{"name":"python-cryptography-doc","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/python-cryptography-doc?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.4-1ubuntu1.4+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1788167137.json"}},{"package":{"name":"python3-cryptography","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/python3-cryptography?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.4-1ubuntu1.4+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1788167137.json"}}],"schema_version":"1.9.0"}