[Security] Bump cryptography from 2.1.4 to 2.3

[dependabot-preview]

Bumps cryptography from 2.1.4 to 2.3. This update includes a security fix.

Vulnerabilities fixed

Sourced from The GitHub Security Advisory Database.

High severity vulnerability that affects cryptography A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.

Affected versions: >= 1.9.0, < 2.3

Changelog

Sourced from cryptography's changelog.

2.3 - 2018-07-18

• SECURITY ISSUE: ~cryptography.hazmat.primitives.ciphers.AEADDecryptionContext.finalize_with_tag allowed tag truncation by default which can allow tag forgery in some cases. The method now enforces the min_tag_length provided to the ~cryptography.hazmat.primitives.ciphers.modes.GCM constructor. CVE-2018-10903
• Added support for Python 3.7.
• Added ~cryptography.fernet.Fernet.extract_timestamp to get the authenticated timestamp of a Fernet </fernet> token.
• Support for Python 2.7.x without hmac.compare_digest has been deprecated. We will require Python 2.7.7 or higher (or 2.7.6 on Ubuntu) in the next cryptography release.
• Fixed multiple issues preventing cryptography from compiling against LibreSSL 2.7.x.
• Added ~cryptography.x509.CertificateRevocationList.get_revoked_certificate_by_serial_number for quick serial number searches in CRLs.
• The ~cryptography.x509.RelativeDistinguishedName class now preserves the order of attributes. Duplicate attributes now raise an error instead of silently discarding duplicates.
• ~cryptography.hazmat.primitives.keywrap.aes_key_unwrap and ~cryptography.hazmat.primitives.keywrap.aes_key_unwrap_with_padding now raise ~cryptography.hazmat.primitives.keywrap.InvalidUnwrap if the wrapped key is an invalid length, instead of ValueError.

2.2.2 - 2018-03-27

• Updated Windows, macOS, and manylinux1 wheels to be compiled with OpenSSL 1.1.0h.

2.2.1 - 2018-03-20

• Reverted a change to GeneralNames which prohibited having zero elements, due to breakages.
• Fixed a bug in ~cryptography.hazmat.primitives.keywrap.aes_key_unwrap_with_padding that caused it to raise InvalidUnwrap when key length modulo 8 was zero.

2.2 - 2018-03-19

• BACKWARDS INCOMPATIBLE: Support for Python 2.6 has been dropped.
• Resolved a bug in HKDF that incorrectly constrained output size.
• Added ~cryptography.hazmat.primitives.asymmetric.ec.BrainpoolP256R1, ~cryptography.hazmat.primitives.asymmetric.ec.BrainpoolP384R1, and ~cryptography.hazmat.primitives.asymmetric.ec.BrainpoolP512R1 to support inter-operating with systems like German smart meters.
• Added token rotation support to Fernet </fernet> with ~cryptography.fernet.MultiFernet.rotate.
• Fixed a memory leak in ~cryptography.hazmat.primitives.asymmetric.ec.derive_private_key.
• Added support for AES key wrapping with padding via ~cryptography.hazmat.primitives.keywrap.aes_key_wrap_with_padding and ~cryptography.hazmat.primitives.keywrap.aes_key_unwrap_with_padding .
• Allow loading DSA keys with 224 bit q.

Commits

• 0a846e2 bump version and changelog for 2.3 release (#4356)
• feb1345 Refs #3331 -- integrated wycheproof ECDH tests (#4354)
• dfb332d improve skip msg when skipping an ECDH test in test_ec (#4355)
• 4de0049 add wycheproof gcm tests (#4349)
• c563b57 min_tag_length is an int (#4351)
• db62ec9 also check iv length for GCM nonce in AEAD (#4350)
• 12a1cac raise ValueError on zero length GCM IV (#4348)
• 7ca0e46 add chacha20poly1305 wycheproof tests (#4345)
• 14faf3c add wycheproof tests for AES CMAC (#4344)
• d4378e4 disallow implicit tag truncation with finalize_with_tag (#4342)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language
• @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

• Update frequency (including time of day and day of week)
• Pull request limits (per update run and/or open at any time)
• Out-of-range updates (receive only lockfile updates, if desired)
• Security updates (receive only security updates, if desired)

[dependabot-preview]

Superseded by #6.