CVSS: 7.8EPSS: 0%CPEs: 5EXPL: 0CVE-2023-50782 – Python-cryptography: bleichenbacher timing oracle attack against rsa decryption - incomplete fix for cve-2020-25659
https://notcve.org/view.php?id=CVE-2023-50782
05 Feb 2024 — A flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data. Se encontró una falla en el paquete python-cryptography. Este problema puede permitir que un atacante remoto descifre mensajes capturados en servidores TLS que utilizan intercambios de claves RSA, lo que puede provocar la exposición de datos confidenciales o sensibles. Hubert Kario dis... • https://access.redhat.com/security/cve/CVE-2023-50782 • CWE-203: Observable Discrepancy CWE-208: Observable Timing Discrepancy •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-49083 – cryptography vulnerable to NULL-dereference when loading PKCS7 certificates
https://notcve.org/view.php?id=CVE-2023-49083
29 Nov 2023 — cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling `load_pem_pkcs7_certificates` or `load_der_pkcs7_certificates` could lead to a NULL-pointer dereference and segfault. Exploitation of this vulnerability poses a serious risk of Denial of Service (DoS) for any application attempting to deserialize a PKCS7 blob/certificate. The consequences extend to potential disruptions in system availability and stability. This vulnerability has been patched in v... • https://github.com/pyca/cryptography/commit/f09c261ca10a31fe41b1262306db7f8f1da0e48a • CWE-476: NULL Pointer Dereference •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-38325
https://notcve.org/view.php?id=CVE-2023-38325
14 Jul 2023 — The cryptography package before 41.0.2 for Python mishandles SSH certificates that have critical options. • https://github.com/pyca/cryptography/compare/41.0.1...41.0.2 • CWE-295: Improper Certificate Validation •
CVSS: 6.5EPSS: 1%CPEs: 1EXPL: 1CVE-2023-23931 – Cipher.update_into can corrupt memory in pyca cryptography
https://notcve.org/view.php?id=CVE-2023-23931
07 Feb 2023 — cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In affected versions `Cipher.update_into` would accept Python objects which implement the buffer protocol, but provide only immutable buffers. This would allow immutable objects (such as `bytes`) to be mutated, thus violating fundamental rules of Python and resulting in corrupted output. This now correctly raises an exception. This issue has been present since `update_into` was originally introduced in cr... • https://github.com/pyca/cryptography/pull/8230/commits/94a50a9731f35405f0357fa5f3b177d46a726ab3 • CWE-754: Improper Check for Unusual or Exceptional Conditions •
CVSS: 9.1EPSS: 1%CPEs: 3EXPL: 1CVE-2020-36242 – python-cryptography: Large inputs for symmetric encryption can trigger integer overflow leading to buffer overflow
https://notcve.org/view.php?id=CVE-2020-36242
07 Feb 2021 — In the cryptography package before 3.3.2 for Python, certain sequences of update calls to symmetrically encrypt multi-GB values could result in an integer overflow and buffer overflow, as demonstrated by the Fernet class. En el paquete de criptografía versiones anteriores a 3.3.2 para Python, determinadas secuencias de llamadas de actualización para cifrar simétricamente valores de varios GB podrían resultar en un desbordamiento de enteros y un desbordamiento del búfer, como es demostrado por la clase Ferne... • https://github.com/pyca/cryptography/blob/master/CHANGELOG.rst • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-190: Integer Overflow or Wraparound CWE-787: Out-of-bounds Write •
CVSS: 5.9EPSS: 0%CPEs: 2EXPL: 0CVE-2020-25659 – python-cryptography: Bleichenbacher timing oracle attack against RSA decryption
https://notcve.org/view.php?id=CVE-2020-25659
03 Nov 2020 — python-cryptography 3.2 is vulnerable to Bleichenbacher timing attacks in the RSA decryption API, via timed processing of valid PKCS#1 v1.5 ciphertext. python-cryptography versión 3.2, es vulnerable a ataques de sincronización de Bleichenbacher en la API de descifrado RSA, por medio del procesamiento cronometrado de texto cifrado PKCS#1 v1.5 válido A flaw was found in python-cryptography, where it is vulnerable to Bleichenbacher timing attacks. This flaw allows an attacker, via the RSA decryption API, to de... • https://github.com/pyca/cryptography/pull/5507/commits/ce1bef6f1ee06ac497ca0c837fbd1c7ef6c2472b • CWE-385: Covert Timing Channel •