openEuler 22.03 LTS SP1 update for python-cryptography
| Risk | Low |
| Patch available | YES |
| Number of vulnerabilities | 1 |
| CVE-ID | CVE-2023-23931 |
| CWE-ID | CWE-388 |
| Exploitation vector | Local |
| Public exploit | N/A |
| Vulnerable software |
openEuler Operating systems & Components / Operating system python-cryptography-help Operating systems & Components / Operating system package or component python3-cryptography Operating systems & Components / Operating system package or component python-cryptography-debugsource Operating systems & Components / Operating system package or component python-cryptography-debuginfo Operating systems & Components / Operating system package or component python-cryptography Operating systems & Components / Operating system package or component |
| Vendor | openEuler |
Security Bulletin
This security bulletin contains one low risk vulnerability.
1) Error Handling
EUVDB-ID: #VU72036
Risk: Low
CVSSv4.0: 1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2023-23931
CWE-ID:
CWE-388 - Error Handling
Exploit availability: No
DescriptionThe vulnerability allows an attacker to misuse Python API.
The vulnerability exists due to a soundness bug within the Cipher.update_into function, which can allow immutable objects (such as bytes) to be mutated. A malicious programmer can misuse Python API to introduce unexpected behavior into the application.
Install updates from vendor's repository.
Vulnerable software versionsopenEuler: 22.03 LTS SP1
python-cryptography-help: before 36.0.1-2
python3-cryptography: before 36.0.1-2
python-cryptography-debugsource: before 36.0.1-2
python-cryptography-debuginfo: before 36.0.1-2
python-cryptography: before 36.0.1-2
CPE2.3- cpe:2.3:o:openeuler:openeuler:22.03:LTS SP1:*:*:*:*:*:*
- cpe:2.3:a:openeuler:python-cryptography-help:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:python3-cryptography:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:python-cryptography-debugsource:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:python-cryptography-debuginfo:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:python-cryptography:*:*:*:*:*:openeuler:*:*
https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2023-1113
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
