CVE-2023-23931: falha de média gravidade em pyca cryptography
Cipher.update_into can corrupt memory in pyca cryptography
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 4.8epss 1.3%
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In affected versions `Cipher.update_into` would accept Python objects which implement the buffer protocol, but provide only immutable buffers. This would allow immutable objects (such as `bytes`) to be mutated, thus violating fundamental rules of Python and resulting in corrupted output. This now correctly raises an exception. This issue has been present since `update_into` was originally introduced in cryptography 1.8.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
Produtos afetados
pyca · cryptographyCVEs relacionadas — pyca cryptography
No mesmo produto, das mais perigosas para as menos.
CVE-2023-49083MEDIUMcryptography vulnerable to NULL-dereference when loading PKCS7 certificatesEPSS 1.0%CVE-2024-26130HIGHcryptography NULL pointer deference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash overrideEPSS 0.8%CVE-2026-39892MEDIUMcryptography has a buffer overflow if non-contiguous buffers were passed to APIsEPSS 0.7%CVE-2026-26007HIGHcryptography Subgroup Attack Due to Missing Subgroup Validation for SECT CurvesEPSS 0.4%CVE-2026-69247HIGHcryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timingEPSS 0.3%CVE-2026-69249HIGHpython-cryptography: Duplicate self-signed intermediates can cause exponential path-buildingEPSS 0.3%
Referências
https://github.com/pyca/cryptography/pull/8230/commits/94a50a9731f35405f0357fa5f3b177d46a726ab3https://github.com/pyca/cryptography/security/advisories/GHSA-w7pp-m8wf-vj6rhttps://lists.debian.org/debian-lts-announce/2024/10/msg00012.htmlhttps://security.netapp.com/advisory/ntap-20230324-0007/