CVE-2023-23931
published 2023-02-07CVE-2023-23931: cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In affected versions `Cipher.update_into` would accept…
PriorityP432medium6.5CVSS 3.1
AVNACLPRNUINSUCNILAL
EPSS
1.30%
67.3th percentile
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In affected versions `Cipher.update_into` would accept Python objects which implement the buffer protocol, but provide only immutable buffers. This would allow immutable objects (such as `bytes`) to be mutated, thus violating fundamental rules of Python and resulting in corrupted output. This now correctly raises an exception. This issue has been present since `update_into` was originally introduced in cryptography 1.8.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cryptography.io | cryptography | >= 1.8 < 39.0.1 | 39.0.1 |
| cryptography.io | cryptography | >= 1.8 < 39.0.1 | 39.0.1 |
| debian | python-cryptography | < python-cryptography 38.0.4-3 (bookworm) | python-cryptography 38.0.4-3 (bookworm) |
| msrc | azl3_python-cryptography_3.3.2-5_on_azure_linux_3.0 | — | — |
| msrc | azure_linux_3.0_arm | — | — |
| msrc | azure_linux_3.0_x64 | — | — |
| msrc | cbl2_python-cryptography_3.3.2-4_on_cbl_mariner_2.0 | — | — |
| msrc | cbl_mariner_1.0_arm | — | — |
| msrc | cbl_mariner_1.0_x64 | — | — |
| msrc | cbl_mariner_2.0_arm | — | — |
| msrc | cbl_mariner_2.0_x64 | — | — |
| msrc | cm1_python-cryptography_3.3.2-2_on_cbl_mariner_1.0 | — | — |
| paloalto | cortex_xdr | — | — |
| paloalto | pan-os | — | — |
| pyca | cryptography | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
osv6.5MEDIUM
vendor_msrc6.5MEDIUM
vendor_oracle6.5MEDIUM
vendor_debian4.8MEDIUM
vendor_redhat4.8MEDIUM
vendor_ubuntu4.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
python-cryptography vulnerabilities
osv·2023-12-06·CVSS 6.5
CVE-2023-23931 [MEDIUM] python-cryptography vulnerabilities
python-cryptography vulnerabilities
It was discovered that the python-cryptography Cipher.update_into function
would incorrectly accept objects with immutable buffers. This would result
in corrupted output, contrary to expectations. This issue only affected
Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 23.04. (CVE-2023-23931)
It was dicovered that python-cryptography incorrectly handled loading
certain PKCS7 certificates. A remote attacker could possibly use this
issue to cause python-cryptography to crash, resulting in a denial of
service. This issue only affected Ubuntu 22.04 LTS, Ubuntu 23.04, and
Ubuntu 23.10. (CVE-2023-49083)
GHSA
Cipher.update_into can corrupt memory if passed an immutable python object as the outbuf
ghsa·2023-02-07
CVE-2023-23931 [MEDIUM] CWE-754 Cipher.update_into can corrupt memory if passed an immutable python object as the outbuf
Cipher.update_into can corrupt memory if passed an immutable python object as the outbuf
Previously, `Cipher.update_into` would accept Python objects which implement the buffer protocol, but provide only immutable buffers:
```pycon
>>> outbuf = b"\x00" * 32
>>> c = ciphers.Cipher(AES(b"\x00" * 32), modes.ECB()).encryptor()
>>> c.update_into(b"\x00" * 16, outbuf)
16
>>> outbuf
b'\xdc\x95\xc0x\xa2@\x89\x89\xadH\xa2\x14\x92\x84 \x87\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
```
This would allow immutable objects (such as `bytes`) to be mutated, thus violating fundamental rules of Python. This is a soundness bug -- it allows programmers to misuse an API, it cannot be exploited by attacker controlled data alone.
This now correctly raises an exception.
This issue has
OSV
Cipher.update_into can corrupt memory if passed an immutable python object as the outbuf
osv·2023-02-07
CVE-2023-23931 [MEDIUM] Cipher.update_into can corrupt memory if passed an immutable python object as the outbuf
Cipher.update_into can corrupt memory if passed an immutable python object as the outbuf
Previously, `Cipher.update_into` would accept Python objects which implement the buffer protocol, but provide only immutable buffers:
```pycon
>>> outbuf = b"\x00" * 32
>>> c = ciphers.Cipher(AES(b"\x00" * 32), modes.ECB()).encryptor()
>>> c.update_into(b"\x00" * 16, outbuf)
16
>>> outbuf
b'\xdc\x95\xc0x\xa2@\x89\x89\xadH\xa2\x14\x92\x84 \x87\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
```
This would allow immutable objects (such as `bytes`) to be mutated, thus violating fundamental rules of Python. This is a soundness bug -- it allows programmers to misuse an API, it cannot be exploited by attacker controlled data alone.
This now correctly raises an exception.
This issue has
OSV
CVE-2023-23931: cryptography is a package designed to expose cryptographic primitives and recipes to Python developers
osv·2023-02-07·CVSS 6.5
CVE-2023-23931 [MEDIUM] CVE-2023-23931: cryptography is a package designed to expose cryptographic primitives and recipes to Python developers
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In affected versions `Cipher.update_into` would accept Python objects which implement the buffer protocol, but provide only immutable buffers. This would allow immutable objects (such as `bytes`) to be mutated, thus violating fundamental rules of Python and resulting in corrupted output. This now correctly raises an exception. This issue has been present since `update_into` was originally introduced in cryptography 1.8.
Palo Alto
PAN-SA-2024-0014 Informational Bulletin: Impact of OSS CVEs in Cortex XDR Agent
vendor_paloalto·2024-11-07·CVSS 6.8
CVE-2014-0195 [MEDIUM] PAN-SA-2024-0014 Informational Bulletin: Impact of OSS CVEs in Cortex XDR Agent
PAN-SA-2024-0014 Informational Bulletin: Impact of OSS CVEs in Cortex XDR Agent
The Palo Alto Networks Product Security Assurance team has evaluated the following open source software (OSS) CVEs as they relate to Cortex XDR Agent. While Cortex XDR Agent may include the
CVEs: CVE-2014-0195, CVE-2014-0224, CVE-2014-3509, CVE-2014-3512, CVE-2014-3513, CVE-2014-3567, CVE-2015-0209, CVE-2015-0292, CVE-2015-1789, CVE-2015-1791, CVE-2015-1793, CVE-2015-3194, CVE-2016-0705, CVE-2016-0797, CVE-2016-0798, CVE-2016-0799, CVE-2016-2105, CVE-2016-2106, CVE-2016-2108, CVE-2016-2109, CVE-2016-2176, CVE-2016-2177, CVE-2016-2179, CVE-2016-2180, CVE-2016-2181, CVE-2016-2182, CVE-2016-2183, CVE-2016-6302, CVE-2016-6303, CVE-2016-6304, CVE-2019-1551, CVE-2019-1552, CVE-2019-1559, CVE-2019-1563, CVE-2020-196
CISA ICS
Siemens SCALANCE XCM-/XRM-300
cisa_ics·2024-02-15
Siemens SCALANCE XCM-/XRM-300
ICS Advisory
##
Siemens SCALANCE XCM-/XRM-300
Release DateFebruary 15, 2024
Alert CodeICSA-24-046-11
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.8
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: SCALANCE XCM-/XRM-300
- Vulnerabilities: Out-of-bounds Write, Incorrect Type Conversion or Cast, Improper Verification of Cryptographic Signature, Improper Access Control, Improper Authentication, Missing Encryption
Palo Alto
PAN-SA-2024-0001 Informational Bulletin: Impact of OSS CVEs in PAN-OS
vendor_paloalto·2024-02-14·CVSS 9.8
CVE-2017-18342 [CRITICAL] PAN-SA-2024-0001 Informational Bulletin: Impact of OSS CVEs in PAN-OS
PAN-SA-2024-0001 Informational Bulletin: Impact of OSS CVEs in PAN-OS
The Palo Alto Networks Product Security Assurance team has evaluated the following open source software (OSS) CVEs as they relate to PAN-OS software. While PAN-OS software may include the
CVEs: CVE-2017-18342, CVE-2017-8923, CVE-2017-9120, CVE-2019-1551, CVE-2019-16865, CVE-2019-16905, CVE-2019-19523, CVE-2019-19528, CVE-2019-19911, CVE-2020-0404, CVE-2020-0431, CVE-2020-0466, CVE-2020-10379, CVE-2020-11538, CVE-2020-11608, CVE-2020-12114, CVE-2020-12321, CVE-2020-12362, CVE-2020-12363, CVE-2020-12364, CVE-2020-13757, CVE-2020-14314, CVE-2020-14351, CVE-2020-15778, CVE-2020-1967, CVE-2020-24394, CVE-2020-24504, CVE-2020-25211, CVE-2020-25212, CVE-2020-25284, CVE-2020-25285, CVE-2020-25717, CVE-2020-26541, CVE-2020-2715
Oracle
Oracle Oracle Analytics Risk Matrix: Analytics Server (Cryptography) — CVE-2023-23931
vendor_oracle·2024-01-15·CVSS 6.5
CVE-2023-23931 [MEDIUM] Oracle Oracle Analytics Risk Matrix: Analytics Server (Cryptography) — CVE-2023-23931
Oracle Oracle Analytics Risk Matrix: Analytics Server (Cryptography) vulnerability
CVE: CVE-2023-23931
CVSS: 6.5
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujan2024 (JAN 2024)
Ubuntu
python-cryptography vulnerabilities
vendor_ubuntu·2023-12-06·CVSS 4.8
CVE-2023-49083 [MEDIUM] python-cryptography vulnerabilities
Title: python-cryptography vulnerabilities
Summary: Several security issues were fixed in python-cryptography.
It was discovered that the python-cryptography Cipher.update_into function
would incorrectly accept objects with immutable buffers. This would result
in corrupted output, contrary to expectations. This issue only affected
Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 23.04. (CVE-2023-23931)
It was dicovered that python-cryptography incorrectly handled loading
certain PKCS7 certificates. A remote attacker could possibly use this
issue to cause python-cryptography to crash, resulting in a denial of
service. This issue only affected Ubuntu 22.04 LTS, Ubuntu 23.04, and
Ubuntu 23.10. (CVE-2023-49083)
Instructions: In general, a standard system update will make all the necessary ch
Oracle
Oracle Oracle Communications Risk Matrix: Configuration (Cryptography) — CVE-2023-23931
vendor_oracle·2023-10-15·CVSS 6.5
CVE-2023-23931 [MEDIUM] Oracle Oracle Communications Risk Matrix: Configuration (Cryptography) — CVE-2023-23931
Oracle Oracle Communications Risk Matrix: Configuration (Cryptography) vulnerability
CVE: CVE-2023-23931
CVSS: 6.5
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuoct2023 (OCT 2023)
Oracle
Oracle Oracle Database Server Risk Matrix: OML4Py (cryptography) — CVE-2023-23931
vendor_oracle·2023-07-15·CVSS 5.4
CVE-2023-23931 [MEDIUM] Oracle Oracle Database Server Risk Matrix: OML4Py (cryptography) — CVE-2023-23931
Oracle Oracle Database Server Risk Matrix: OML4Py (cryptography) vulnerability
CVE: CVE-2023-23931
CVSS: 5.4
Protocol: Oracle Net
Remote exploit: No
Affected versions: Network
Advisory: cpujul2023 (JUL 2023)
Oracle
Oracle Oracle Communications Risk Matrix: Platform (Cryptography) — CVE-2023-23931
vendor_oracle·2023-04-15·CVSS 6.5
CVE-2023-23931 [MEDIUM] Oracle Oracle Communications Risk Matrix: Platform (Cryptography) — CVE-2023-23931
Oracle Oracle Communications Risk Matrix: Platform (Cryptography) vulnerability
CVE: CVE-2023-23931
CVSS: 6.5
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuapr2023 (APR 2023)
Microsoft
Cipher.update_into can corrupt memory in pyca cryptography
vendor_msrc·2023-02-14·CVSS 6.5
CVE-2023-23931 [MEDIUM] CWE-754 Cipher.update_into can corrupt memory in pyca cryptography
Cipher.update_into can corrupt memory in pyca cryptography
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
GitHub_M: GitHub_M
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: http
Red Hat
python-cryptography: memory corruption via immutable objects
vendor_redhat·2023-02-08·CVSS 4.8
CVE-2023-23931 [MEDIUM] CWE-754 python-cryptography: memory corruption via immutable objects
python-cryptography: memory corruption via immutable objects
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In affected versions `Cipher.update_into` would accept Python objects which implement the buffer protocol, but provide only immutable buffers. This would allow immutable objects (such as `bytes`) to be mutated, thus violating fundamental rules of Python and resulting in corrupted output. This now correctly raises an exception. This issue has been present since `update_into` was originally introduced in cryptography 1.8.
A vulnerability was found in python-cryptography. In affected versions, `Cipher.update_into` would accept Python objects which implement the buffer protocol but provide only immutable buffers. This issue allow
Debian
CVE-2023-23931: python-cryptography - cryptography is a package designed to expose cryptographic primitives and recipe...
vendor_debian·2023·CVSS 4.8
CVE-2023-23931 [MEDIUM] CVE-2023-23931: python-cryptography - cryptography is a package designed to expose cryptographic primitives and recipe...
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In affected versions `Cipher.update_into` would accept Python objects which implement the buffer protocol, but provide only immutable buffers. This would allow immutable objects (such as `bytes`) to be mutated, thus violating fundamental rules of Python and resulting in corrupted output. This now correctly raises an exception. This issue has been present since `update_into` was originally introduced in cryptography 1.8.
Scope: local
bookworm: resolved (fixed in 38.0.4-3)
bullseye: resolved (fixed in 3.3.2-1+deb11u1)
forky: resolved (fixed in 38.0.4-3)
sid: resolved (fixed in 38.0.4-3)
trixie: resolved (fixed in 38.0.4-3)
No detection rules found.
No public exploits indexed.
https://github.com/pyca/cryptography/pull/8230/commits/94a50a9731f35405f0357fa5f3b177d46a726ab3https://github.com/pyca/cryptography/security/advisories/GHSA-w7pp-m8wf-vj6rhttps://github.com/pyca/cryptography/pull/8230/commits/94a50a9731f35405f0357fa5f3b177d46a726ab3https://github.com/pyca/cryptography/security/advisories/GHSA-w7pp-m8wf-vj6rhttps://lists.debian.org/debian-lts-announce/2024/10/msg00012.htmlhttps://security.netapp.com/advisory/ntap-20230324-0007/
2023-02-07
Published