Skip to content
OpenAdvisories
Medium ELSA-2023-7096 1 CVE

Moderate: python-cryptography security update (Oracle Linux 8)

Published Nov 17, 2023 · Updated Nov 17, 2023

Ecosystem: Oracle Linux

Summary

[3.2.1-6]
- Fix CVE-2023-23931: Don't allow update_into to mutate immutable objects, resolves rhbz#2172404

Fixed packages 1

ReleasePackageFixed in
Oracle Linux · 8 python3-cryptography 0:3.2.1-6.el8

Vulnerabilities 1

  • Medium 4.8
    CVE-2023-23931

    Cipher.update_into can corrupt memory in pyca cryptography

    cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In affected versions `Cipher.update_into` would accept Python objects which implement the buffer protocol, but provide only immutable buffers. This would a…

    pyca cryptography mitmproxy cryptography Debian Ubuntu Azure Linux Alpine Wolfi PyPI