Skip to content
OpenAdvisories
Medium RHSA-2023:6615 1 CVE

Red Hat Security Advisory: python-cryptography security update

Published Sep 13, 2024 · Updated Aug 5, 2026

Ecosystem: Red Hat

Fixed packages 4

ReleasePackageFixed in
Red Hat · RHEL 9 enterprise_linux:9::baseos python-cryptography 0:36.0.1-4.el9
Red Hat · RHEL 9 enterprise_linux:9::baseos python-cryptography-debugsource 0:36.0.1-4.el9
Red Hat · RHEL 9 enterprise_linux:9::baseos python3-cryptography 0:36.0.1-4.el9
Red Hat · RHEL 9 enterprise_linux:9::baseos python3-cryptography-debuginfo 0:36.0.1-4.el9

Vulnerabilities 1

  • Medium 4.8
    CVE-2023-23931

    Cipher.update_into can corrupt memory in pyca cryptography

    cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In affected versions `Cipher.update_into` would accept Python objects which implement the buffer protocol, but provide only immutable buffers. This would a…

    pyca cryptography mitmproxy cryptography Debian Ubuntu Azure Linux Alpine Wolfi PyPI

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • article
    https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.3_release_notes/index
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2171817
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2172399
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2203840
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_6615.json
  • report
    https://access.redhat.com/security/cve/CVE-2023-23931
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-23931
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-23931
  • article
    https://github.com/pyca/cryptography/security/advisories/GHSA-w7pp-m8wf-vj6r