CVE-2023-23931 Cipher.update_into can corrupt memory in pyca cryptography
Attackers can corrupt memory by passing immutable buffers to Cipher.update_into, leading to data modification in applications using the pyca cryptography library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-23931?
CVE-2023-23931 is a medium-severity memory corruption vulnerability in pyca cryptography, published on 7 Feb 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In affected versions `Cipher.update_into` would accept Python objects which implement the buffer protocol, but provide only immutable buffers. This would allow immutable objects (such as `bytes`) to be mutated, thus violating fundamental rules of Python and resulting in corrupted output. This now correctly raises an exception. This issue has been present since `update_into` was originally introduced in cryptography 1.8.
Weakness: CWE-754
Which versions are affected by CVE-2023-23931?
3 open source packages ship an affected version, including cryptography. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
cryptography PyPI | From 1.8 | 39.0.1 |
cryptography PyPI | From 1.8 | 39.0.1 |
cryptography PyPI | From 1.8 | 39.0.1 |
Linux distribution packages (37)
python3-cryptography AlmaLinux:8 | All versions | 3.2.1-6.el8 |
python3-cryptography AlmaLinux:9 | All versions | 36.0.1-4.el9 |
python-cryptography Red Hat:enterprise_linux:8::baseos | All versions | 0:3.2.1-6.el8 |
python-cryptography-debugsource Red Hat:enterprise_linux:8::baseos | All versions | 0:3.2.1-6.el8 |
python3-cryptography Red Hat:enterprise_linux:8::baseos | All versions | 0:3.2.1-6.el8 |
python3-cryptography-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:3.2.1-6.el8 |
python-cryptography Red Hat:enterprise_linux:9::baseos | All versions | 0:36.0.1-4.el9 |
python-cryptography-debugsource Red Hat:enterprise_linux:9::baseos | All versions | 0:36.0.1-4.el9 |
python3-cryptography Red Hat:enterprise_linux:9::baseos | All versions | 0:36.0.1-4.el9 |
python3-cryptography-debuginfo Red Hat:enterprise_linux:9::baseos | All versions | 0:36.0.1-4.el9 |
python-cffi SUSE:HPE Helion OpenStack 8 | All versions | 1.10.0-4.3.1 |
python-cryptography SUSE:HPE Helion OpenStack 8 | All versions | 2.0.3-3.14.2 |
venv-openstack-aodh SUSE:HPE Helion OpenStack 8 | All versions | 5.1.1~dev7-12.44.1 |
venv-openstack-barbican SUSE:HPE Helion OpenStack 8 | All versions | 5.0.2~dev3-12.47.1 |
venv-openstack-ceilometer SUSE:HPE Helion OpenStack 8 | All versions | 9.0.8~dev7-12.42.1 |
venv-openstack-cinder SUSE:HPE Helion OpenStack 8 | All versions | 11.2.3~dev29-14.46.1 |
venv-openstack-designate SUSE:HPE Helion OpenStack 8 | All versions | 5.0.3~dev7-12.43.1 |
venv-openstack-freezer SUSE:HPE Helion OpenStack 8 | All versions | 5.0.0.0~xrc2~dev2-10.40.1 |
venv-openstack-glance SUSE:HPE Helion OpenStack 8 | All versions | 15.0.3~dev3-12.43.1 |
venv-openstack-heat SUSE:HPE Helion OpenStack 8 | All versions | 9.0.8~dev22-12.49.1 |
venv-openstack-horizon-hpe SUSE:HPE Helion OpenStack 8 | All versions | 12.0.5~dev6-14.52.1 |
venv-openstack-ironic SUSE:HPE Helion OpenStack 8 | All versions | 9.1.8~dev8-12.45.1 |
venv-openstack-keystone SUSE:HPE Helion OpenStack 8 | All versions | 12.0.4~dev11-11.49.1 |
venv-openstack-magnum SUSE:HPE Helion OpenStack 8 | All versions | 5.0.2_5.0.2_5.0.2~dev31-11.44.1 |
venv-openstack-manila SUSE:HPE Helion OpenStack 8 | All versions | 5.1.1~dev5-12.49.1 |
venv-openstack-monasca SUSE:HPE Helion OpenStack 8 | All versions | 2.2.2~dev1-11.49.1 |
venv-openstack-monasca-ceilometer SUSE:HPE Helion OpenStack 8 | All versions | 1.5.1_1.5.1_1.5.1~dev3-8.40.1 |
venv-openstack-murano SUSE:HPE Helion OpenStack 8 | All versions | 4.0.2~dev3-12.42.1 |
venv-openstack-neutron SUSE:HPE Helion OpenStack 8 | All versions | 11.0.9~dev69-13.50.1 |
venv-openstack-nova SUSE:HPE Helion OpenStack 8 | All versions | 16.1.9~dev92-11.48.1 |
venv-openstack-octavia SUSE:HPE Helion OpenStack 8 | All versions | 1.0.6~dev3-12.45.1 |
venv-openstack-sahara SUSE:HPE Helion OpenStack 8 | All versions | 7.0.5~dev4-11.44.1 |
venv-openstack-swift SUSE:HPE Helion OpenStack 8 | All versions | 2.15.2_2.15.2_2.15.2~dev32-11.35.1 |
venv-openstack-trove SUSE:HPE Helion OpenStack 8 | All versions | 8.0.2~dev2-11.44.1 |
python-cryptography SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS | All versions | 2.9.2-150100.7.12.1 |
python-cryptography SUSE:Linux Enterprise Micro 5.1 | All versions | 3.3.2-150200.19.1 |
python-cryptography SUSE:Linux Enterprise Micro 5.2 | All versions | 3.3.2-150200.19.1 |
Products include Cryptography.io Cryptography.
How do I fix CVE-2023-23931?
Upgrade cryptography to 39.0.1 or later.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2023-23931 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-23931 exists.
Other vulnerabilities in pyca cryptography
- CVE-2020-36242 PyCA Cryptography symmetrically encrypting large values can lead to integer overflow
- CVE-2026-26007 cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves
- CVE-2024-26130 cryptography NULL pointer dereference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override
- CVE-2023-38325 cryptography mishandles SSH certificates
- CVE-2026-39892 cryptography has a buffer overflow if non-contiguous buffers were passed to APIs
Sources
Also known as ALPINE-CVE-2023-23931, ALSA-2023:6615, ALSA-2023:7096, AZL-13353, AZL-35127, DEBIAN-CVE-2023-23931 and 27 more.