Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS13N3BwLW04d2Ytdmo2cs4AAxeE

Cipher.update_into can corrupt memory if passed an immutable python object as the outbuf

Previously, Cipher.update_into would accept Python objects which implement the buffer protocol, but provide only immutable buffers:

>>> outbuf = b"\x00" * 32
>>> c = ciphers.Cipher(AES(b"\x00" * 32), modes.ECB()).encryptor()
>>> c.update_into(b"\x00" * 16, outbuf)
16
>>> outbuf
b'\xdc\x95\xc0x\xa2@\x89\x89\xadH\xa2\x14\x92\x84 \x87\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'

This would allow immutable objects (such as bytes) to be mutated, thus violating fundamental rules of Python. This is a soundness bug -- it allows programmers to misuse an API, it cannot be exploited by attacker controlled data alone.

This now correctly raises an exception.

This issue has been present since update_into was originally introduced in cryptography 1.8.

Permalink: https://github.com/advisories/GHSA-w7pp-m8wf-vj6r
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS13N3BwLW04d2Ytdmo2cs4AAxeE
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: about 1 year ago
Updated: 8 months ago


CVSS Score: 6.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Identifiers: GHSA-w7pp-m8wf-vj6r, CVE-2023-23931
References: Repository: https://github.com/pyca/cryptography
Blast Radius: 33.3

Affected Packages

pypi:cryptography
Dependent packages: 2,599
Dependent repositories: 131,580
Downloads: 247,831,888 last month
Affected Version Ranges: >= 1.8, < 39.0.1
Fixed in: 39.0.1
All affected versions: 1.8.1, 1.8.2, 2.0.1, 2.0.2, 2.0.3, 2.1.1, 2.1.2, 2.1.3, 2.1.4, 2.2.1, 2.2.2, 2.3.1, 2.4.1, 2.4.2, 2.6.1, 2.9.1, 2.9.2, 3.1.1, 3.2.1, 3.3.1, 3.3.2, 3.4.1, 3.4.2, 3.4.3, 3.4.4, 3.4.5, 3.4.6, 3.4.7, 3.4.8, 35.0.0, 36.0.0, 36.0.1, 36.0.2, 37.0.0, 37.0.1, 37.0.2, 37.0.3, 37.0.4, 38.0.0, 38.0.1, 38.0.2, 38.0.3, 38.0.4, 39.0.0
All unaffected versions: 0.2.1, 0.2.2, 0.5.1, 0.5.2, 0.5.3, 0.5.4, 0.6.1, 0.7.1, 0.7.2, 0.8.1, 0.8.2, 0.9.1, 0.9.2, 0.9.3, 1.0.1, 1.0.2, 1.1.1, 1.1.2, 1.2.1, 1.2.2, 1.2.3, 1.3.1, 1.3.2, 1.3.3, 1.3.4, 1.5.1, 1.5.2, 1.5.3, 1.7.1, 1.7.2, 39.0.1, 39.0.2, 40.0.0, 40.0.1, 40.0.2, 41.0.0, 41.0.1, 41.0.2, 41.0.3, 41.0.4, 41.0.5, 41.0.6, 41.0.7, 42.0.0, 42.0.1, 42.0.2, 42.0.3, 42.0.4, 42.0.5