CVE-2016-9243 Ubuntu Security Notification for Python-cryptography Vulnerability (USN-3138-1)

It was discovered that python-cryptography incorrectly handled certain HKDF lengths.

This could result in python-cryptography returning an empty string instead of the expected derived key.

Refer to Ubuntu advisory USN-3138-1 for affected packages and patching details, or update with your package manager.

Patch:
Following are links for downloading patches to fix the vulnerabilities:

USN-3138-1: 16.04 (Xenial) on src (python-cryptography)

USN-3138-1: 16.10 (Yakkety) on src (python-cryptography)

USN-3138-1: 16.10 (Yakkety) on src (python3-cryptography)

USN-3138-1: 16.04 (Xenial) on src (python3-cryptography)