CVE-2023-23931Medium· 6.5▾ SunlitCipher.update_into can corrupt memory if passed an immutable python object as the outbuf
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.3 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
1.3%
Previously, Cipher.update_into would accept Python objects which implement the buffer protocol, but provide only immutable buffers:
>>> outbuf = b"\x00" * 32
>>> c = ciphers.Cipher(AES(b"\x00" * 32), modes.ECB()).encryptor()
>>> c.update_into(b"\x00" * 16, outbuf)
16
>>> outbuf
b'\xdc\x95\xc0x\xa2@\x89\x89\xadH\xa2\x14\x92\x84 \x87\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
This would allow immutable objects (such as bytes) to be mutated, thus violating fundamental rules of Python. This is a soundness bug -- it allows programmers to misuse an API, it cannot be exploited by attacker controlled data alone.
This now correctly raises an exception.
This issue has been present since update_into was originally introduced in cryptography 1.8.
cryptography >= 1.8, < 39.0.1Upgrade to a patched release:
cryptography 39.0.1Connected by shared product, vendor, weakness, or advisory.
CVE-2023-49083Medium· 5.9cryptography vulnerable to NULL-dereference when loading PKCS7 certificates
GHSA-v8gr-m533-ghj9LowVulnerable OpenSSL included in cryptography wheels
CVE-2026-34073Medium· 5.3cryptography has incomplete DNS name constraint enforcement on peer names
GHSA-jm77-qphf-c4w8Lowpyca/cryptography's wheels include vulnerable OpenSSL
GHSA-h4gh-qq45-vh27Mediumpyca/cryptography has a vulnerable OpenSSL included in cryptography wheels
CVE-2023-38325High· 7.5cryptography mishandles SSH certificates