Security update for python-ecdsa

SUSE Security Update: Security update for python-ecdsa
Announcement ID: SUSE-SU-2019:2891-1
Rating: moderate
References: #1153165 #1154217
Cross-References: CVE-2019-14853 CVE-2019-14859
Affected Products:
  • SUSE Linux Enterprise Module for Public Cloud 15
  • SUSE Linux Enterprise Module for Packagehub Subpackages 15
  • SUSE Linux Enterprise Module for Open Buildservice Development Tools 15-SP1
  • SUSE Linux Enterprise Module for Open Buildservice Development Tools 15
  • SUSE Linux Enterprise Module for Basesystem 15-SP1

An update that fixes two vulnerabilities is now available.

Description:

This update for python-ecdsa to version 0.13.3 fixes the following issues:
Security issues fixed:

  • CVE-2019-14853: Fixed unexpected exceptions during signature decoding (bsc#1153165).
  • CVE-2019-14859: Fixed a signature malleability caused by insufficient checks of DER encoding (bsc#1154217).

Patch Instructions:

To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

  • SUSE Linux Enterprise Module for Public Cloud 15:
    zypper in -t patch SUSE-SLE-Module-Public-Cloud-15-2019-2891=1
  • SUSE Linux Enterprise Module for Packagehub Subpackages 15:
    zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-2019-2891=1
  • SUSE Linux Enterprise Module for Open Buildservice Development Tools 15-SP1:
    zypper in -t patch SUSE-SLE-Module-Development-Tools-OBS-15-SP1-2019-2891=1
  • SUSE Linux Enterprise Module for Open Buildservice Development Tools 15:
    zypper in -t patch SUSE-SLE-Module-Development-Tools-OBS-15-2019-2891=1
  • SUSE Linux Enterprise Module for Basesystem 15-SP1:
    zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP1-2019-2891=1

Package List:

  • SUSE Linux Enterprise Module for Public Cloud 15 (noarch):
    • python3-ecdsa-0.13.3-3.3.1
  • SUSE Linux Enterprise Module for Packagehub Subpackages 15 (noarch):
    • python2-ecdsa-0.13.3-3.3.1
  • SUSE Linux Enterprise Module for Open Buildservice Development Tools 15-SP1 (noarch):
    • python2-ecdsa-0.13.3-3.3.1
  • SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 (noarch):
    • python2-ecdsa-0.13.3-3.3.1
  • SUSE Linux Enterprise Module for Basesystem 15-SP1 (noarch):
    • python3-ecdsa-0.13.3-3.3.1

References: