Skip to content
OpenAdvisories
Medium RHSA-2023:7096 1 CVE

Red Hat Security Advisory: python-cryptography security update

Published Sep 13, 2024 · Updated Aug 5, 2026

Ecosystem: Red Hat

Fixed packages 4

ReleasePackageFixed in
Red Hat · RHEL 8 enterprise_linux:8::baseos python-cryptography 0:3.2.1-6.el8
Red Hat · RHEL 8 enterprise_linux:8::baseos python-cryptography-debugsource 0:3.2.1-6.el8
Red Hat · RHEL 8 enterprise_linux:8::baseos python3-cryptography 0:3.2.1-6.el8
Red Hat · RHEL 8 enterprise_linux:8::baseos python3-cryptography-debuginfo 0:3.2.1-6.el8

Vulnerabilities 1

  • Medium 4.8
    CVE-2023-23931

    Cipher.update_into can corrupt memory in pyca cryptography

    cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In affected versions `Cipher.update_into` would accept Python objects which implement the buffer protocol, but provide only immutable buffers. This would a…

    pyca cryptography mitmproxy cryptography Debian Ubuntu Azure Linux Alpine Wolfi PyPI

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • article
    https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.9_release_notes/index
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2171817
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2172404
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_7096.json
  • report
    https://access.redhat.com/security/cve/CVE-2023-23931
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-23931
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-23931
  • article
    https://github.com/pyca/cryptography/security/advisories/GHSA-w7pp-m8wf-vj6r