Import Source
https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-13353.json
JSON Data
https://api.test.osv.dev/v1/vulns/AZL-13353
Upstream
Published
2023-02-07T21:15:09Z
Modified
2026-04-01T05:07:39.715493Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L CVSS Calculator
Summary
CVE-2023-23931 affecting package python-cryptography for versions less than 3.3.2-4
Details

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In affected versions Cipher.update_into would accept Python objects which implement the buffer protocol, but provide only immutable buffers. This would allow immutable objects (such as bytes) to be mutated, thus violating fundamental rules of Python and resulting in corrupted output. This now correctly raises an exception. This issue has been present since update_into was originally introduced in cryptography 1.8.

References

Affected packages

Azure Linux:2 / python-cryptography

Package

Name
python-cryptography
Purl
pkg:rpm/azure-linux/python-cryptography

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.3.2-4

Database specific

source
"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-13353.json"