Skip to content
Fencer Vulns
medium 4.8

CVE-2023-23931 json

Cipher.update_into can corrupt memory in pyca cryptography

published 2023-02-07 3 y ago modified 2026-09-10 1 mo ago also GHSA-w7pp-m8wf-vj6r , PYSEC-2023-11 , EUVD-2023-0058

cvss
4.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.3%
EPSS 1.3% chance of exploitation in 30 days, percentile 70%
public exploits
0
none known

Summary

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In affected versions `Cipher.update_into` would accept Python objects which implement the buffer protocol, but provide only immutable buffers. This would allow immutable objects (such as `bytes`) to be mutated, thus violating fundamental rules of Python and resulting in corrupted output. This now correctly raises an exception. This issue has been present since `update_into` was originally introduced in cryptography 1.8.

Patch / fix

  • pypi cryptography 39.0.1
  • cryptography.io cryptography 39.0.1
  • python-cryptography Debian 14, Debian 13, Debian 12 38.0.4-3

debian advisories DEBIAN-CVE-2023-23931

  • python-cryptography Ubuntu 20.04 LTS 2.8-3ubuntu0.2
  • python-cryptography Ubuntu 22.04 LTS 3.4.8-1ubuntu2.1
  • python-cryptography Ubuntu Pro 18.04 LTS 2.1.4-1ubuntu1.4+esm6

ubuntu advisories UBUNTU-CVE-2023-23931

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • python-gitpython ansible automation platform 2.4 3.1.32-1.el9ap
  • python3-gitpython ansible automation platform 2.4 3.1.32-1.el9ap
  • python39-gitpython ansible automation platform 2.4 3.1.32-1.el8ap
  • python3x-gitpython ansible automation platform 2.4 3.1.32-1.el8ap
  • automation-controller-venv-tower ansible automation platform 2.4 4.4.3-1.el8ap
  • automation-controller-venv-tower ansible automation platform 2.4 4.4.3-1.el9ap
  • numpy RHEL 8 1.19.4-3.module+el8.9.0+19644+d68f775d
  • scipy RHEL 8 1.5.4-5.module+el8.9.0+19644+d68f775d

red hat advisories RHSA-2023:4971RHSA-2024:2985RHSA-2023:6793RHSA-2023:4693RHSA-2023:7096RHSA-2023:6615

  • python-cryptography OpenStack Cloud Crowbar 9, OpenStack Cloud 9 2.3.1-3.6.6
  • venv-openstack-heat OpenStack Cloud 9 11.0.4~dev4-3.41.2
  • venv-openstack-nova OpenStack Cloud 9 18.3.1~dev92-3.47.2
  • venv-openstack-swift OpenStack Cloud 9 2.19.2~dev48-2.34.2
  • venv-openstack-cinder OpenStack Cloud 9 13.0.10~dev24-3.42.3
  • venv-openstack-glance OpenStack Cloud 9 17.0.1~dev30-3.37.2
  • venv-openstack-ironic OpenStack Cloud 9 11.1.5~dev18-4.37.2
  • venv-openstack-magnum OpenStack Cloud 9 7.2.1~dev1-4.39.3

suse advisories SUSE-SU-2023:2218-1SUSE-SU-2023:2144-1SUSE-SU-2023:0722-2SUSE-SU-2023:1767-1SUSE-SU-2023:1763-1SUSE-SU-2023:0839-1

  • python-oci-sdk openSUSE Tumbleweed 2.180.0-1.2
  • python-cryptography openSUSE Tumbleweed 44.0.0-1.1
  • python-cryptography openSUSE Tumbleweed 39.0.1-1.1

opensuse advisories openSUSE-SU-2026:12020-1openSUSE-SU-2025:14739-1openSUSE-SU-2024:12681-1

  • python39 AlmaLinux 8 3.9.18-3.module_el8.10.0+3765+2f9a457d
  • python39-py AlmaLinux 8 1.10.0-1.module_el8.6.0+2780+a40f65e1
  • python39-pip AlmaLinux 8 20.2.4-9.module_el8.10.0+3765+2f9a457d
  • python39-ply AlmaLinux 8 3.11-10.module_el8.6.0+2780+a40f65e1
  • python39-six AlmaLinux 8 1.15.0-3.module_el8.6.0+2780+a40f65e1
  • python39-cffi AlmaLinux 8 1.14.3-2.module_el8.6.0+2780+a40f65e1
  • python39-cffi AlmaLinux 8 1.14.3-2.module_el8.6.0+3248+c431e88c
  • python39-idle AlmaLinux 8 3.9.18-3.module_el8.10.0+3765+2f9a457d

almalinux advisories ALSA-2024:2985ALSA-2023:7096ALSA-2023:6615

  • numpy Rocky Linux 8 1.19.4-3.module+el8.10.0+1582+bc278001
  • scipy Rocky Linux 8 1.5.4-5.module+el8.10.0+1582+bc278001
  • Cython Rocky Linux 8 0.29.21-5.module+el8.10.0+1582+bc278001
  • pytest Rocky Linux 8 6.0.2-2.module+el8.10.0+1582+bc278001
  • PyYAML Rocky Linux 8 5.4.1-1.module+el8.10.0+1582+bc278001
  • mod_wsgi Rocky Linux 8 4.7.1-7.module+el8.10.0+1582+bc278001
  • pybind11 Rocky Linux 8 2.7.1-1.module+el8.9.0+1357+a3b80af7
  • python-py Rocky Linux 8 1.10.0-1.module+el8.10.0+1582+bc278001

rocky linux advisories RLSA-2024:2985

  • py3-cryptography Alpine 3.17 38.0.3-r1
  • py3-cryptography Alpine 3.24, Alpine 3.23, Alpine 3.22 +4 more 39.0.1-r0

alpine advisories ALPINE-CVE-2023-23931

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • python-cryptography CBL-Mariner 2.0 3.3.2-4
  • python-cryptography Azure Linux 3.0 3.3.2-5

azure linux advisories AZL-13353AZL-35127

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-23931 updated cvss 6.5

python-cryptography: memory corruption via immutable objects

  • Red Hat Discovery 1 discovery-server-container
    affected: no fix available
  • Red Hat Enterprise Linux 7 python-cryptography, python2-cryptography
    affected: no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 8 python-cryptography, python3-cryptography Red Hat OpenShift Data Science (RHODS) odh-minimal-notebook-container
    affected: no fix planned “Will not fix”
  • Red Hat OpenStack Platform 13 (Queens) python-cryptography, python2-cryptography, python2-cryptography-vectors
    affected: no fix planned “Out of support scope”
  • Red Hat Update Infrastructure 4 for Cloud Providers python-cryptography
    affected: no fix planned “Will not fix”
  • Red Hat Quay v3 quay/quay-rhel8 v3.10.0-150
    fixed: vendor fix RHSA-2023:7341
  • Red Hat Ansible Automation Platform 2.4 for RHEL 8 python39-cryptography 38.0.4-2.el8ap, python3x-cryptography 38.0.4-2.el8ap, automation-controller-venv-tower 4.4.3-1.el8ap Red Hat Ansible Automation Platform 2.4 for RHEL 9 python-cryptography 38.0.4-2.el9ap, python3-cryptography 38.0.4-2.el9ap, automation-controller-venv-tower 4.4.3-1.el9ap
    fixed: vendor fix RHSA-2023:4693
  • Red Hat Enterprise Linux AppStream (v. 8) scipy 1.5.4-5.module+el8.9.0+19644+d68f775d, numpy 1.19.4-3.module+el8.9.0+19644+d68f775d, PyYAML 5.4.1-1.module+el8.9.0+19644+d68f775d, mod_wsgi 4.7.1-7.module+el8.9.0+19644+d68f775d, python-idna 2.10-3.module+el8.9.0+19644+d68f775d, python-ply 3.11-10.module+el8.9.0+19644+d68f775d, +49 more
    fixed: vendor fix RHSA-2024:2985
show 5 more
  • Red Hat Enterprise Linux BaseOS (v. 8) python-cryptography 3.2.1-6.el8, python3-cryptography 3.2.1-6.el8
    fixed: vendor fix RHSA-2023:7096
  • Red Hat Enterprise Linux BaseOS (v. 9) python-cryptography 36.0.1-4.el9, python3-cryptography 36.0.1-4.el9
    fixed: vendor fix RHSA-2023:6615
  • Red Hat Enterprise Linux CRB (v. 8) pytest 6.0.2-2.module+el8.9.0+19644+d68f775d, Cython 0.29.21-5.module+el8.9.0+19644+d68f775d, pybind11 2.7.1-1.module+el8.9.0+19644+d68f775d, python-py 1.10.0-1.module+el8.9.0+19644+d68f775d, python39-py 1.10.0-1.module+el8.9.0+19644+d68f775d, python-attrs 20.3.0-2.module+el8.9.0+19644+d68f775d, +16 more
    fixed: vendor fix RHSA-2024:2985
  • Red Hat Software Collections for RHEL Workstation(v. 7) rh-python38-python-cryptography 2.8-6.el7 Red Hat Software Collections for RHEL(v. 7) rh-python38-python-cryptography 2.8-6.el7
    fixed: vendor fix RHSA-2023:6793
  • Red Hat Quay v3 quay/clair-rhel8 v3.10.0-20, quay/quay-builder-rhel8 v3.10.0-17, quay/quay-operator-rhel8 v3.10.0-37, quay/quay-operator-bundle v3.10.0-154, quay/quay-builder-qemu-rhcos-rhel8 v3.10.0-10, quay/quay-container-security-operator-rhel8 v3.10.0-19, +1 more Red Hat Ansible Automation Platform 2 ansible-lint, ansible-navigator Red Hat Ansible Automation Platform 2.4 for RHEL 8 python39-rsa 4.7.2-1.el8ap, python3x-rsa 4.7.2-1.el8ap, ansible-core 2.15.3-1.el8ap, ansible-test 2.15.3-1.el8ap, python39-django 3.2.20-1.el8ap, python3x-django 3.2.20-1.el8ap, +11 more Red Hat Ansible Automation Platform 2.4 for RHEL 9 python-rsa 4.7.2-1.el9ap, python3-rsa 4.7.2-1.el9ap, ansible-core 2.15.3-1.el9ap, ansible-test 2.15.3-1.el9ap, python-django 3.2.20-1.el9ap, python3-django 3.2.20-1.el9ap, +11 more Red Hat Enterprise Linux 8 python3.11-cryptography Red Hat Enterprise Linux 9 python3.11-cryptography
    +4 more products
    Red Hat JBoss Enterprise Application Platform 7 python-cryptography Red Hat JBoss Enterprise Application Platform Expansion Pack python-cryptography Red Hat Software Collections for RHEL Workstation(v. 7) rh-python38-python 3.8.18-2.el7, rh-python38-python-pip 19.3.1-4.el7, rh-python38-python-idle 3.8.18-2.el7, rh-python38-python-libs 3.8.18-2.el7, rh-python38-python-test 3.8.18-2.el7, rh-python38-python-wheel 0.33.6-9.el7, +8 more Red Hat Software Collections for RHEL(v. 7) rh-python38-python 3.8.18-2.el7, rh-python38-python-pip 19.3.1-4.el7, rh-python38-python-idle 3.8.18-2.el7, rh-python38-python-libs 3.8.18-2.el7, rh-python38-python-test 3.8.18-2.el7, rh-python38-python-wheel 0.33.6-9.el7, +8 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-24-046-11 updated cvss 4.8

Siemens SCALANCE XCM-/XRM-300

  • Siemens SCALANCE XCH328 (6GK5328-4TS01-2EC2) <V2.4 Siemens SCALANCE XCM324 (6GK5324-8TS01-2AC2) <V2.4 Siemens SCALANCE XCM328 (6GK5328-4TS01-2AC2) <V2.4 Siemens SCALANCE XCM332 (6GK5332-0GA01-2AC2) <V2.4 Siemens SCALANCE XRH334 (24 V DC, 8xFO, CC) (6GK5334-2TS01-2ER3) <V2.4 Siemens SCALANCE XRM334 (2x230 V AC, 8xFO) (6GK5334-2TS01-4AR3) <V2.4
    +5 more products
    Siemens SCALANCE XRM334 (2x230 V AC, 12xFO) (6GK5334-3TS01-4AR3) <V2.4 Siemens SCALANCE XRM334 (24 V DC, 8xFO) (6GK5334-2TS01-2AR3) <V2.4 Siemens SCALANCE XRM334 (24 V DC, 12xFO) (6GK5334-3TS01-2AR3) <V2.4 Siemens SCALANCE XRM334 (230 V AC, 8xFO) (6GK5334-2TS01-3AR3) <V2.4 Siemens SCALANCE XRM334 (230 V AC, 12xFO) (6GK5334-3TS01-3AR3) <V2.4
    affected: fixed in V2.4 support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
19 mo ago

Exploit prediction

1.30% chance of exploitation in the next 30 days, higher than 70% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/pyca/cryptography/security/advisories/GHSA-w7pp-m8wf-vj6r referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
NVD 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
GitHub 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Affected packages

ecosystem package affected fixed in
pypi cryptography
>=1.8, <39.0.1
39.0.1

Affected products

  • pyca cryptography

Classification

Weakness
  • CWE-754 Improper Check for Unusual or Exceptional Conditions

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.