The vulnerability of the Python programming language’s cryptography interpreter lies in errors in the certificate validation process, which allows attackers to execute a type of “man-in-the-middle” attack.

🗓️ 11 Sep 2023 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 4 Views

The Python cryptography interpreter has certificate validation errors that enable man-in-the-middle attacks.

Reporter	Title	Published	Views	Family All 65
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to weakened security in Python Cryptographic Authority [CVE-2023-38325]	30 Nov 202318:53	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Network Automation 2.6.2 fixes multiple security vulnerabilities	6 Oct 202316:11	–	ibm
IBM Security Bulletins	Security Bulletin: Storage Virtualize ansible collection is affected by a vulnerability in the Python Cryptographic Authority package [CVE-2023-38325]	9 Oct 202313:41	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities exists in IBM Netezza Performance Server Replication Services	27 Feb 202619:55	–	ibm
IBM Security Bulletins	Security Bulletin: z/Transaction Processing Facility is affected by a vulnerability in the Python Cryptographic Authority package [CVE-2023-38325]	29 Aug 202323:49	–	ibm
IBM Security Bulletins	Security Bulletin: QRadar Suite Software includes components with multiple known vulnerabilities	15 Feb 202413:10	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Python Cryptographic Authority cryptography affects IBM Process Mining . CVE-2023-38325	11 Oct 202309:25	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge for IBM Cloud Pak for Data affected by vulnerability in Python Cryptographic Authority cryptography	27 Sep 202321:10	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in CloudPak for Watson AIOps	26 Mar 202503:58	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in cryptography may affect IBM Spectrum Sentinel Anomaly Scan Engine (CVE-2023-23931, CVE-2023-38325)	15 Dec 202313:02	–	ibm

Vulners

Node

wazuh,wazuhMatch4.4.5

OR

fedora fedoraMatch38

Source	Link
github	www.github.com/pyca/cryptography/pull/9208
github	www.github.com/pyca/cryptography/issues/9207
github	www.github.com/pyca/cryptography/compare/41.0.1...41.0.2
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/NMCCTYY3CSNQBFFYYC5DAV6KATHWCUZK/
pypi	www.pypi.org/project/cryptography/
security	www.security.netapp.com/advisory/ntap-20230824-0010/
cybersecurity-help	www.cybersecurity-help.cz/vdb/SB2023081446
vuldb	www.vuldb.com/ru/
web	www.web.nvd.nist.gov/view/vuln/detail

13 Sep 2024 00:00Current

6.5Medium risk

Vulners AI Score6.5

CVSS 37.5

CVSS 27.8

EPSS0.00613

python cryptography interpreter certificate validation errors man in middle