CVE-2023-23931
Cipher.update_into can corrupt memory in pyca cryptography
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In affected versions `Cipher.update_into` would accept Python objects which implement the buffer protocol, but provide only immutable buffers. This would allow immutable objects (such as `bytes`) to be mutated, thus violating fundamental rules of Python and resulting in corrupted output. This now correctly raises an exception. This issue has been present since `update_into` was originally introduced in cryptography 1.8.
A vulnerability was found in python-cryptography. In affected versions, `Cipher.update_into` would accept Python objects which implement the buffer protocol but provide only immutable buffers. This issue allows immutable objects (such as `bytes`) to be mutated, thus violating the fundamental rules of Python, resulting in corrupted output.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2023-01-19 CVE Reserved
- 2023-02-07 CVE Published
- 2024-08-02 CVE Updated
- 2024-08-02 First Exploit
- 2024-08-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-754: Improper Check for Unusual or Exceptional Conditions
CAPEC
References (4)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|---|---|
| https://github.com/pyca/cryptography/security/advisories/GHSA-w7pp-m8wf-vj6r | 2024-08-02 |
| URL | Date | SRC |
|---|---|---|
| https://github.com/pyca/cryptography/pull/8230/commits/94a50a9731f35405f0357fa5f3b177d46a726ab3 | 2023-02-16 |
| URL | Date | SRC |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2023-23931 | 2024-05-22 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2171817 | 2024-05-22 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Cryptography Project Search vendor "Cryptography Project" | Cryptography Search vendor "Cryptography Project" for product "Cryptography" | >= 1.8 < 39.0.1 Search vendor "Cryptography Project" for product "Cryptography" and version " >= 1.8 < 39.0.1" | python |
Affected
| ||||||