CVE-2023-23931CWE-754

Cipher.update_into can corrupt memory in pyca cryptography

Medium · published February 7, 2023

CVSS v3.1
4.8
EPSS
1%
Percentile
70.2
In the wild
Unconfirmed
What it is

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In affected versions `Cipher.update_into` would accept Python objects which implement the buffer protocol, but provide only immutable buffers. This would allow immutable objects (such as `bytes`) to be mutated, thus violating fundamental rules of Python and resulting in corrupted output. This now correctly raises an exception. This issue has been present since `update_into` was originally introduced in cryptography 1.8.

The record
Technical detail
CVSS v3.1
4.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.01301 · 70.2th percentile
Weakness
CWE-754 · Improper Check for Unusual or Exceptional Conditions
Published
2023-02-07T20:54Z
EPSS history
Timeline
  • 07 FEB 20:54Z
    Cipher.update_into can corrupt memory in pyca cryptography
    cvelistv5