Skip to content
OpenAdvisories
Medium ELSA-2023-6615 1 CVE

Moderate: python-cryptography security update (Oracle Linux 9)

Published Nov 11, 2023 · Updated Nov 11, 2023

Ecosystem: Oracle Linux

Summary

[36.0.1-4]
- Fix FTBFS caused by rsa_pkcs1_implicit_rejection OpenSSL feature, resolves rhbz#2203840

[36.0.1-3]
- Fix CVE-2023-23931: Don't allow update_into to mutate immutable objects, resolves rhbz#2172399
- Fix FTBFS due to failing test_load_invalid_ec_key_from_pem and test_decrypt_invalid_decrypt

Fixed packages 1

ReleasePackageFixed in
Oracle Linux · 9 python3-cryptography 0:36.0.1-4.el9

Vulnerabilities 1

  • Medium 4.8
    CVE-2023-23931

    Cipher.update_into can corrupt memory in pyca cryptography

    cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In affected versions `Cipher.update_into` would accept Python objects which implement the buffer protocol, but provide only immutable buffers. This would a…

    pyca cryptography mitmproxy cryptography Debian Ubuntu Azure Linux Alpine Wolfi PyPI