pysec-2023-11
Vulnerability from pysec
Published
2023-02-07 21:15
Modified
2023-05-04 03:49
Details
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In affected versions Cipher.update_into
would accept Python objects which implement the buffer protocol, but provide only immutable buffers. This would allow immutable objects (such as bytes
) to be mutated, thus violating fundamental rules of Python and resulting in corrupted output. This now correctly raises an exception. This issue has been present since update_into
was originally introduced in cryptography 1.8.
Aliases
{ "affected": [ { "package": { "ecosystem": "PyPI", "name": "cryptography", "purl": "pkg:pypi/cryptography" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "94a50a9731f35405f0357fa5f3b177d46a726ab3" } ], "repo": "https://github.com/pyca/cryptography", "type": "GIT" }, { "events": [ { "introduced": "1.8" }, { "fixed": "39.0.1" } ], "type": "ECOSYSTEM" } ], "versions": [ "1.8", "1.8.1", "1.8.2", "1.9", "2.0", "2.0.1", "2.0.2", "2.0.3", "2.1", "2.1.1", "2.1.2", "2.1.3", "2.1.4", "2.2", "2.2.1", "2.2.2", "2.3", "2.3.1", "2.4", "2.4.1", "2.4.2", "2.5", "2.6", "2.6.1", "2.7", "2.8", "2.9", "2.9.1", "2.9.2", "3.0", "3.1", "3.1.1", "3.2", "3.2.1", "3.3", "3.3.1", "3.3.2", "3.4", "3.4.1", "3.4.2", "3.4.3", "3.4.4", "3.4.5", "3.4.6", "3.4.7", "3.4.8", "35.0.0", "36.0.0", "36.0.1", "36.0.2", "37.0.0", "37.0.1", "37.0.2", "37.0.3", "37.0.4", "38.0.0", "38.0.1", "38.0.2", "38.0.3", "38.0.4", "39.0.0" ] } ], "aliases": [ "CVE-2023-23931", "GHSA-w7pp-m8wf-vj6r" ], "details": "cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In affected versions `Cipher.update_into` would accept Python objects which implement the buffer protocol, but provide only immutable buffers. This would allow immutable objects (such as `bytes`) to be mutated, thus violating fundamental rules of Python and resulting in corrupted output. This now correctly raises an exception. This issue has been present since `update_into` was originally introduced in cryptography 1.8.", "id": "PYSEC-2023-11", "modified": "2023-05-04T03:49:45.221186Z", "published": "2023-02-07T21:15:00Z", "references": [ { "type": "EVIDENCE", "url": "https://github.com/pyca/cryptography/security/advisories/GHSA-w7pp-m8wf-vj6r" }, { "type": "ADVISORY", "url": "https://github.com/pyca/cryptography/security/advisories/GHSA-w7pp-m8wf-vj6r" }, { "type": "FIX", "url": "https://github.com/pyca/cryptography/pull/8230/commits/94a50a9731f35405f0357fa5f3b177d46a726ab3" } ] }
Loading...
Loading...
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.