CVE-2023-23931 Cipher.update_into can corrupt memory in pyca cryptography

2023-02-0720:54:03

CWE-754

GitHub_M

www.cve.org

cve-2023-23931

cipher.update_into

memory corruption

pyca cryptography

python

immutable objects

corrupted output

exception

cryptography 1.8

4.8 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

7.1 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

29.0%

JSON

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In affected versions Cipher.update_into would accept Python objects which implement the buffer protocol, but provide only immutable buffers. This would allow immutable objects (such as bytes) to be mutated, thus violating fundamental rules of Python and resulting in corrupted output. This now correctly raises an exception. This issue has been present since update_into was originally introduced in cryptography 1.8.

CNA Affected

[
  {
    "vendor": "pyca",
    "product": "cryptography",
    "versions": [
      {
        "version": ">=1.8, < 39.0.1",
        "status": "affected"
      }
    ]
  }
]