Vulnerabilities > CVE-2023-23931 - Improper Check for Unusual or Exceptional Conditions vulnerability in Cryptography.Io Cryptography

CVSS 6.5 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

LOW

Availability impact

LOW

network

low complexity

cryptography-io

CWE-754

NVD

Published: 2023-02-07

Updated: 2024-09-05

Summary

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In affected versions `Cipher.update_into` would accept Python objects which implement the buffer protocol, but provide only immutable buffers. This would allow immutable objects (such as `bytes`) to be mutated, thus violating fundamental rules of Python and resulting in corrupted output. This now correctly raises an exception. This issue has been present since `update_into` was originally introduced in cryptography 1.8.

Vulnerable Configurations

Part	Description	Count
Application	Cryptography.Io Cryptography.Io Cryptography 1.8 Cryptography.Io Cryptography 1.8.1 Cryptography.Io Cryptography 1.8.2 Cryptography.Io Cryptography 1.9 Cryptography.Io Cryptography 2.0 Cryptography.Io Cryptography 2.0.1 Cryptography.Io Cryptography 2.0.2 Cryptography.Io Cryptography 2.0.3 Cryptography.Io Cryptography 2.1 Cryptography.Io Cryptography 2.1.1 Cryptography.Io Cryptography 2.1.2 Cryptography.Io Cryptography 2.1.3 Cryptography.Io Cryptography 2.1.4 Cryptography.Io Cryptography 2.2 Cryptography.Io Cryptography 2.2.1 Cryptography.Io Cryptography 2.2.2 Cryptography.Io Cryptography 2.3 Cryptography.Io Cryptography 2.3.1 Cryptography.Io Cryptography 2.4 Cryptography.Io Cryptography 2.4.1 Cryptography.Io Cryptography 2.4.2 Cryptography.Io Cryptography 2.5 Cryptography.Io Cryptography 2.6 Cryptography.Io Cryptography 2.6.1 Cryptography.Io Cryptography 2.7 Cryptography.Io Cryptography 2.8 Cryptography.Io Cryptography 2.9 Cryptography.Io Cryptography 2.9.1 Cryptography.Io Cryptography 2.9.2 Cryptography.Io Cryptography 3.0 Cryptography.Io Cryptography 3.1 Cryptography.Io Cryptography 3.1.1 Cryptography.Io Cryptography 3.2 Cryptography.Io Cryptography 3.2.1 Cryptography.Io Cryptography 3.3 Cryptography.Io Cryptography 3.3.1 Cryptography.Io Cryptography 3.3.2 Cryptography.Io Cryptography 3.4 Cryptography.Io Cryptography 3.4.1 Cryptography.Io Cryptography 3.4.2 Cryptography.Io Cryptography 3.4.3 Cryptography.Io Cryptography 3.4.4 Cryptography.Io Cryptography 3.4.5 Cryptography.Io Cryptography 3.4.6 Cryptography.Io Cryptography 3.4.7 Cryptography.Io Cryptography 3.4.8 Cryptography.Io Cryptography 35.0.0 Cryptography.Io Cryptography 36.0.0 Cryptography.Io Cryptography 36.0.1 Cryptography.Io Cryptography 36.0.2 Cryptography.Io Cryptography 37.0.0 Cryptography.Io Cryptography 37.0.1 Cryptography.Io Cryptography 37.0.2 Cryptography.Io Cryptography 37.0.3 Cryptography.Io Cryptography 37.0.4 Cryptography.Io Cryptography 38.0.0 Cryptography.Io Cryptography 38.0.1 Cryptography.Io Cryptography 38.0.2 Cryptography.Io Cryptography 38.0.3 Cryptography.Io Cryptography 38.0.4 Cryptography.Io Cryptography 39.0.0	61

Common Weakness Enumeration (CWE)

CWE-754 - Improper Check for Unusual or Exceptional Conditions

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References