-
Type: Bug
-
Status: Resolved
-
Priority: Critical
-
Resolution: Fixed
-
Affects Version/s: 3.0.4
-
Fix Version/s: 3.1.0
-
Component/s: Packaging / Build
Heap-based buffer overflow in the ALGnew function in block_templace.c in Python Cryptography Toolkit (aka pycrypto) 2.6.1 allows remote attackers to execute arbitrary code as demonstrated by a crafted iv parameter to cryptmsg.py.
It is the good occasion to move to pycryptodomex, a more up-to-date framework, Python 3 compatible.
Notes:
- before the change, add tests for encrypt() and decrypt() from utils.py.
- is related to
-
NXDRIVE-2057 Move to tinyaes for cryptography stuff
- Resolved