UBUNTU-CVE-2023-23931

See a problem?
Source
https://ubuntu.com/security/notices/UBUNTU-CVE-2023-23931
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2023/UBUNTU-CVE-2023-23931.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2023-23931
Related
Published
2023-02-07T21:15:00Z
Modified
2023-02-07T21:15:00Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L CVSS Calculator
Summary
[none]
Details

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In affected versions Cipher.update_into would accept Python objects which implement the buffer protocol, but provide only immutable buffers. This would allow immutable objects (such as bytes) to be mutated, thus violating fundamental rules of Python and resulting in corrupted output. This now correctly raises an exception. This issue has been present since update_into was originally introduced in cryptography 1.8.

References

Affected packages

Ubuntu:Pro:18.04:LTS / python-cryptography

Package

Name
python-cryptography

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.9-1

2.*

2.1.3-3
2.1.4-1
2.1.4-1build1
2.1.4-1build2
2.1.4-1ubuntu1
2.1.4-1ubuntu1.1
2.1.4-1ubuntu1.2
2.1.4-1ubuntu1.3
2.1.4-1ubuntu1.4
2.1.4-1ubuntu1.4+esm1

Ecosystem specific 

{
    "ubuntu_priority": "low"
}

Ubuntu:20.04:LTS / python-cryptography

Package

Name
python-cryptography
Purl
pkg:deb/ubuntu/python-cryptography@2.8-3ubuntu0.2?arch=src?distro=focal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.8-3ubuntu0.2

Affected versions

2.*

2.6.1-3.1
2.6.1-4
2.6.1-4ubuntu1
2.8-1ubuntu2
2.8-2
2.8-3
2.8-3ubuntu0.1

Ecosystem specific 

{
    "availability": "No subscription required",
    "ubuntu_priority": "low",
    "binaries": [
        {
            "python-cryptography": "2.8-3ubuntu0.2",
            "python-cryptography-dbgsym": "2.8-3ubuntu0.2",
            "python-cryptography-doc": "2.8-3ubuntu0.2",
            "python3-cryptography": "2.8-3ubuntu0.2",
            "python3-cryptography-dbgsym": "2.8-3ubuntu0.2"
        }
    ]
}

Ubuntu:22.04:LTS / python-cryptography

Package

Name
python-cryptography
Purl
pkg:deb/ubuntu/python-cryptography@3.4.8-1ubuntu2.1?arch=src?distro=jammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.4.8-1ubuntu2.1

Affected versions

3.*

3.3.2-1
3.3.2-1build1
3.4.8-1
3.4.8-1ubuntu1
3.4.8-1ubuntu2

Ecosystem specific 

{
    "availability": "No subscription required",
    "ubuntu_priority": "low",
    "binaries": [
        {
            "python-cryptography-doc": "3.4.8-1ubuntu2.1",
            "python3-cryptography": "3.4.8-1ubuntu2.1",
            "python3-cryptography-dbgsym": "3.4.8-1ubuntu2.1"
        }
    ]
}