Sweet32 attack (DES, 3DES)¶
Warning
This resource is maintained for historical reference and does not contain the latest vulnerability info for Python.
The canonical database for vulnerabilities affecting Python is available on GitHub in the Open Source Vulnerability (OSV) format. This vulnerability can be viewed online at the Open Source Vulnerability Database.
Remove 3DES from ssl default cipher list.
Sweet32 vulnerability found by Karthik Bhargavan and Gaetan Leurent from the INRIA.
Dates:
- Disclosure date: 2016-08-24 (end of the Sweet32 embargo)
- Reported by: Karthik Bhargavan and Gaetan Leurent (Sweet32)
Fixed In¶
- Python 2.7.13 (2016-12-17) fixed by commit d988f42 (branch 2.7) (2016-09-06)
- Python 3.4.7 (2017-08-09) fixed by commit fa53dbd (branch 3.4) (2017-03-10)
- Python 3.5.3 (2017-01-16) fixed by commit 03d13c0 (branch 3.5) (2016-09-06)
- Python 3.6.0 (2016-12-22) fixed by commit 03d13c0 (branch 3.5) (2016-09-06)
Python issue¶
Remove 3DES from cipher list (sweet32 CVE-2016-2183).
- Python issue: bpo-27850
- Creation date: 2016-08-24
- Reporter: Christian Heimes
CVE-2016-2183¶
The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTPS session using Triple DES in CBC mode, aka a “Sweet32” attack.
- CVE ID: CVE-2016-2183
- Published: 2016-09-01
- CVSS Score: 5.0
Timeline¶
Timeline using the disclosure date 2016-08-24 as reference:
- 2016-08-24: Disclosure date (end of the Sweet32 embargo)
- 2016-08-24: Python issue bpo-27850 reported by Christian Heimes
- 2016-09-01 (+8 days): CVE-2016-2183 published
- 2016-09-06 (+13 days): commit 03d13c0 (branch 3.5)
- 2016-09-06 (+13 days): commit d988f42 (branch 2.7)
- 2016-12-17 (+115 days): Python 2.7.13 released
- 2016-12-22: Python 3.6.0 released
- 2017-01-16 (+145 days): Python 3.5.3 released
- 2017-03-10 (+198 days): commit fa53dbd (branch 3.4)
- 2017-08-09 (+350 days): Python 3.4.7 released