Error Handling in python-cryptography - CVE-2023-23931

Vulnerability identifier: #VU72036

CSH Severity: Low

CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-23931

CWE-ID: CWE-388

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows an attacker to misuse Python API.

The vulnerability exists due to a soundness bug within the Cipher.update_into function, which can allow immutable objects (such as bytes) to be mutated. A malicious programmer can misuse Python API to introduce unexpected behavior into the application.

python-cryptography
Oracle Linux
Amazon Linux AMI
Gentoo Linux
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Server for SAP Applications 12
SUSE CaaS Platform
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
openSUSE Leap Micro
HPE Helion Openstack
SUSE OpenStack Cloud
SUSE OpenStack Cloud Crowbar
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Anolis OS
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for x86_64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for IBM z Systems
Oracle Solaris
SUSE Linux Enterprise Server 15 SP1 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS
Basesystem Module
openSUSE Leap
openEuler
Ubuntu
Fedora
z/Transaction Processing Facility ( z/TPF)
PowerVC
Ansible Automation Platform
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
IBM Watson Assistant for IBM Cloud Pak for Data
Oracle Communications Cloud Native Core Binding Support Function
Oracle Communications Cloud Native Core Network Exposure Function
Oracle Communications Cloud Native Core Network Repository Function
IBM Cloud Pak for Data System
Spectrum Discover
IBM Watson Knowledge Catalog in Cloud Pak for Data
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Decision Optimization for Cloud Pak for Data
Data Replication on Cloud Pak for Data
App Connect Enterprise Certified Container
IBM Spectrum Protect Plus
PowerProtect Data Manager
Juniper Cloud Native Router
SmartFabric Storage Software
PowerScale OneFS
Junos cRPD
IBM Cloud Pak for Multicloud Management
Red Hat OpenShift Container Platform
RecoverPoint for Virtual Machines
IBM Qradar SIEM
Cloud Pak for Security (CP4S)
Oracle Business Intelligence Enterprise Edition
Storage Sentinel Anomaly Scan Engine
ObjectScale
Cloud Pak for Network Automation
QRadar Deployment Intelligence App
PowerStore T
PeopleSoft Enterprise PeopleTools
Oracle Database Server
Oracle Communications Cloud Native Core Security Edge Protection Proxy
Oracle Communications Cloud Native Core Network Function Cloud Native Environment
python39-wcwidth
python39-PyMySQL
python39-toml
python39-pluggy
python39-Cython
rh-python38-python-wheel (Red Hat package)
python39-wheel-wheel
python39-wheel
automation-eda-controller (Red Hat package)
venv-openstack-octavia-x86_64
python39-iniconfig
venv-openstack-monasca-ceilometer-x86_64
python39-scipy
python39-pysocks
python39-py
python-cffi
python-cffi-debugsource
python-cffi-debuginfo
python3-cffi
python3-cffi-debuginfo
python39-cffi
python39-six
python39-numpy-doc
python39-numpy-f2py
python39-numpy
python39-urllib3
python-cryptography-debuginfo
python-cryptography
python-cryptography-debugsource
venv-openstack-monasca-x86_64
python39-pyparsing
python39-pybind11-devel
python39-pybind11
python3-cryptography (Ubuntu package)
python-cryptography (Ubuntu package)
rh-python38-python-cryptography (Red Hat package)
python39-psycopg2-tests
python39-psycopg2-doc
python39-psycopg2
python3-cryptography-debuginfo
python3-cryptography
python2-cryptography
python2-cryptography-debuginfo
python39-idna
venv-openstack-swift-x86_64
ansible-core (Red Hat package)
python39-pycparser
rh-python38-python-requests (Red Hat package)
python39-requests
python3x-requests (Red Hat package)
python-requests (Red Hat package)
python39-chardet
python3x-gitpython (Red Hat package)
python-gitpython (Red Hat package)
python-cryptography (Red Hat package)
python3x-django (Red Hat package)
python-django (Red Hat package)
python39-cryptography
python-cryptography-help
rh-python38-python (Red Hat package)
python39-idle
python39-devel
python39-libs
python39-test
python39-tkinter
python39-debug
python39
python39-rpm-macros
python39-ply
venv-openstack-murano-x86_64
automation-controller (Red Hat package)
python39-lxml
python39-mod_wsgi
python3x-rsa (Red Hat package)
python-rsa (Red Hat package)
venv-openstack-freezer-x86_64
venv-openstack-barbican-x86_64
venv-openstack-magnum-x86_64
venv-openstack-designate-x86_64
venv-openstack-manila-x86_64
venv-openstack-aodh-x86_64
python39-pyyaml
python39-psutil
python39-pytest
venv-openstack-sahara-x86_64
venv-openstack-trove-x86_64
python39-more-itertools
venv-openstack-ceilometer-x86_64
venv-openstack-heat-x86_64
venv-openstack-ironic-x86_64
venv-openstack-neutron-x86_64
venv-openstack-cinder-x86_64
venv-openstack-keystone-x86_64
venv-openstack-horizon-x86_64
venv-openstack-horizon-hpe-x86_64
venv-openstack-glance-x86_64
venv-openstack-nova-x86_64
rh-python38-python-pip (Red Hat package)
python39-pip-wheel
python39-pip
python39-attrs
python39-packaging
python3x-cryptography (Red Hat package)
python3-cryptography-doc
rh-python38-python-setuptools (Red Hat package)
dev-python/cryptography
python39-setuptools-wheel
python39-setuptools
Quay
Splunk Security Orchestration, Automation and Response (SOAR)

Install updates from vendor's website.

python-cryptography - update to 39.0.1
SmartFabric Storage Software - update to 1.4.3
IBM Cloud Pak for Multicloud Management - update to 2.3.8
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 4.8.0
IBM Watson Assistant for IBM Cloud Pak for Data - update to 4.7.0
RecoverPoint for Virtual Machines - update to 6.0 SP2 P1
IBM Qradar SIEM - update to 7.5.0 Update Pack 8
python39-wcwidth - update to 0.2.5-3
python39-PyMySQL - update to 0.10.1-2
python39-toml - update to 0.10.1-5
python39-pluggy - update to 0.13.1-3
python39-Cython - update to 0.29.21-5
rh-python38-python-wheel (Red Hat package) - update to 0.33.6-9.el7
python39-wheel-wheel - update to 0.35.1-4
python39-wheel - update to 0.35.1-4
automation-eda-controller (Red Hat package) - addressed in versions 1.0.1-1.el8ap, 1.0.1-1.el9ap
venv-openstack-octavia-x86_64 - addressed in versions 1.0.6~dev3-12.45.1, 3.2.3~dev7-4.39.2
IBM Cloud Pak for Data System - update to 1.0.8.0
python39-iniconfig - update to 1.1.1-2
Storage Sentinel Anomaly Scan Engine - update to 1.1.6
ObjectScale - update to 1.4.0
venv-openstack-monasca-ceilometer-x86_64 - addressed in versions 1.5.1_1.5.1_1.5.1~dev3-8.40.1, 1.8.2~dev3-3.39.2
python39-scipy - update to 1.5.4-5.0.1
python39-pysocks - update to 1.7.1-4
python39-py - update to 1.10.0-1
python-cffi - addressed in versions 1.10.0-4.3.1, 1.11.5-3.3.1, 1.11.5-5.19.1
python-cffi-debugsource - addressed in versions 1.10.0-4.3.1, 1.11.5-3.3.1, 1.11.5-5.19.1
python-cffi-debuginfo - addressed in versions 1.10.0-4.3.1, 1.11.5-3.3.1, 1.11.5-5.19.1
Cloud Pak for Security (CP4S) - update to 1.10.12.0
python3-cffi - update to 1.11.5-5.19.1
python3-cffi-debuginfo - update to 1.11.5-5.19.1
python39-cffi - update to 1.14.3-2
python39-six - update to 1.15.0-3
python39-numpy-doc - update to 1.19.4-3.0.1
python39-numpy-f2py - update to 1.19.4-3.0.1
python39-numpy - update to 1.19.4-3.0.1
python39-urllib3 - update to 1.25.10-5
python-cryptography-debuginfo - addressed in versions 2.0.3-3.14.2, 2.3.1-3.6.6, 2.8-7.40.1, 2.9.2-150100.7.12.1, 3.3.2-150200.19.1
python-cryptography - addressed in versions 2.0.3-3.14.2, 2.3.1-3.6.6, 2.8-7.40.1
python-cryptography-debugsource - addressed in versions 2.0.3-3.14.2, 2.3.1-3.6.6, 2.8-7.40.1, 2.9.2-150100.7.12.1, 3.3.2-150200.19.1, 3.3.2-150400.16.6.1
Spectrum Discover - addressed in versions 2.0.4.8, 2.1.1
venv-openstack-monasca-x86_64 - addressed in versions 2.2.2~dev1-11.49.1, 2.7.1~dev10-3.41.2
Cloud Pak for Network Automation - update to 2.4.5
python39-pyparsing - update to 2.4.7-5
python39-pybind11-devel - update to 2.7.1-1
python39-pybind11 - update to 2.7.1-1
python3-cryptography (Ubuntu package) - addressed in versions 2.8-3ubuntu0.2, 3.4.8-1ubuntu2.1, 38.0.4-2ubuntu0.1, 38.0.4-4ubuntu0.23.10.1
python-cryptography (Ubuntu package) - update to 2.8-3ubuntu0.2
rh-python38-python-cryptography (Red Hat package) - update to 2.8-6.el7
python39-psycopg2-tests - update to 2.8.6-3.0.1
python39-psycopg2-doc - update to 2.8.6-3.0.1
python39-psycopg2 - update to 2.8.6-3.0.1
python3-cryptography-debuginfo - addressed in versions 2.8-7.40.1, 2.9.2-150100.7.12.1, 3.3.2-150200.19.1, 3.3.2-150400.16.6.1
python3-cryptography - addressed in versions 2.8-7.40.1, 2.9.2-150100.7.12.1, 3.3.2-150200.19.1, 3.3.2-150400.16.6.1
python2-cryptography - update to 2.9.2-150100.7.12.1
python2-cryptography-debuginfo - update to 2.9.2-150100.7.12.1
python39-idna - update to 2.10-4
venv-openstack-swift-x86_64 - addressed in versions 2.15.2_2.15.2_2.15.2~dev32-11.35.1, 2.19.2~dev48-2.34.2
ansible-core (Red Hat package) - addressed in versions 2.15.3-1.el8ap, 2.15.3-1.el9ap
python39-pycparser - update to 2.20-3
rh-python38-python-requests (Red Hat package) - update to 2.22.0-11.el7
python39-requests - update to 2.25.0-3
python3x-requests (Red Hat package) - update to 2.31.0-1.el8ap
python-requests (Red Hat package) - update to 2.31.0-1.el9ap
python39-chardet - update to 3.0.4-19
QRadar Deployment Intelligence App - update to 3.0.16
python3x-gitpython (Red Hat package) - update to 3.1.32-1.el8ap
python-gitpython (Red Hat package) - update to 3.1.32-1.el9ap
python3-cryptography - addressed in versions 3.2.1-6, 39.0.0-3
python-cryptography (Red Hat package) - addressed in versions 3.2.1-6.el8, 36.0.1-4.el9, 38.0.4-2.el9ap
python3x-django (Red Hat package) - update to 3.2.20-1.el8ap
python-django (Red Hat package) - update to 3.2.20-1.el9ap
python39-cryptography - update to 3.3.1-3
python2-cryptography - update to 3.3.1-3
python-cryptography - addressed in versions 3.3.1-3, 3.3.1-5, 36.0.1-2
python-cryptography-help - addressed in versions 3.3.1-3, 3.3.1-5, 36.0.1-2
python-cryptography-debugsource - addressed in versions 3.3.1-3, 3.3.1-5, 36.0.1-2
python3-cryptography - addressed in versions 3.3.1-3, 3.3.1-5, 36.0.1-2
python-cryptography-debuginfo - addressed in versions 3.3.1-3, 3.3.1-5, 36.0.1-2
PowerStore T - update to 3.5.0.1-2083289
rh-python38-python (Red Hat package) - update to 3.8.18-2.el7
python39-idle - update to 3.9.19-2.0.1
python39-devel - update to 3.9.19-2.0.1
python39-libs - update to 3.9.19-2.0.1
python39-test - update to 3.9.19-2.0.1
python39-tkinter - update to 3.9.19-2.0.1
python39-debug - update to 3.9.19-2.0.1
python39 - update to 3.9.19-2.0.1
python39-rpm-macros - update to 3.9.19-2.0.1
Quay - update to 3.10.0
python39-ply - update to 3.11-10
venv-openstack-murano-x86_64 - update to 4.0.2~dev3-12.42.1
automation-controller (Red Hat package) - addressed in versions 4.4.3-1.el8ap, 4.4.3-1.el9ap
IBM Watson Knowledge Catalog in Cloud Pak for Data - update to 4.6.4
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.6.5
python39-lxml - update to 4.6.5-1
IBM Decision Optimization for Cloud Pak for Data - update to 4.7
python39-mod_wsgi - update to 4.7.1-7
python3x-rsa (Red Hat package) - update to 4.7.2-1.el8ap
python-rsa (Red Hat package) - update to 4.7.2-1.el9ap
Data Replication on Cloud Pak for Data - update to 4.8.0
Red Hat OpenShift Container Platform - addressed in versions 4.16.15, 4.17.0
venv-openstack-freezer-x86_64 - update to 5.0.0.0~xrc2~dev2-10.40.1
venv-openstack-barbican-x86_64 - addressed in versions 5.0.2~dev3-12.47.1, 7.0.1~dev24-3.41.2
venv-openstack-magnum-x86_64 - addressed in versions 5.0.2_5.0.2_5.0.2~dev31-11.44.1, 7.2.1~dev1-4.39.3
venv-openstack-designate-x86_64 - addressed in versions 5.0.3~dev7-12.43.1, 7.0.2~dev2-3.39.2
App Connect Enterprise Certified Container - addressed in versions 5.0.19, 12.2.0
venv-openstack-manila-x86_64 - addressed in versions 5.1.1~dev5-12.49.1, 7.4.2~dev60-3.45.2
venv-openstack-aodh-x86_64 - update to 5.1.1~dev7-12.44.1
python39-pyyaml - update to 5.4.1-1
python39-psutil - update to 5.8.0-4.0.1
python39-pytest - update to 6.0.2-2.0.1
venv-openstack-sahara-x86_64 - addressed in versions 7.0.5~dev4-11.44.1, 9.0.2~dev15-3.39.2
venv-openstack-trove-x86_64 - update to 8.0.2~dev2-11.44.1
python39-more-itertools - update to 8.5.0-2
venv-openstack-ceilometer-x86_64 - update to 9.0.8~dev7-12.42.1
venv-openstack-heat-x86_64 - addressed in versions 9.0.8~dev22-12.49.1, 11.0.4~dev4-3.41.2
venv-openstack-ironic-x86_64 - addressed in versions 9.1.8~dev8-12.45.1, 11.1.5~dev18-4.37.2
PowerScale OneFS - addressed in versions 9.4.0.18, 9.7.1.0
IBM Spectrum Protect Plus - update to 10.1.14
venv-openstack-neutron-x86_64 - addressed in versions 11.0.9~dev69-13.50.1, 13.0.8~dev209-6.47.2
venv-openstack-cinder-x86_64 - addressed in versions 11.2.3~dev29-14.46.1, 13.0.10~dev24-3.42.3
venv-openstack-keystone-x86_64 - addressed in versions 12.0.4~dev11-11.49.1, 14.2.1~dev9-3.40.2
venv-openstack-horizon-x86_64 - addressed in versions 12.0.5~dev6-14.52.1, 14.1.1~dev11-4.47.2
venv-openstack-horizon-hpe-x86_64 - update to 12.0.5~dev6-14.52.1
venv-openstack-glance-x86_64 - addressed in versions 15.0.3~dev3-12.43.1, 17.0.1~dev30-3.37.2
venv-openstack-nova-x86_64 - addressed in versions 16.1.9~dev92-11.48.1, 18.3.1~dev92-3.47.2
rh-python38-python-pip (Red Hat package) - update to 19.3.1-4.el7
PowerProtect Data Manager - update to 19.19.0-15
python39-pip-wheel - update to 20.2.4-9
python39-pip - update to 20.2.4-9
python39-attrs - update to 20.3.0-2
python39-packaging - update to 20.4-4
Juniper Cloud Native Router - update to 23.4R1
Junos cRPD - update to 23.4R1
python-cryptography - addressed in versions 36.0.0-4.fc36, 37.0.2-5.fc37, 37.0.2-8.fc38, 37.0.2-8.fc39
python-cryptography - update to 36.0.1-1
python3x-cryptography (Red Hat package) - update to 38.0.4-2.el8ap
python3-cryptography-doc - update to 39.0.0-3
Splunk Security Orchestration, Automation and Response (SOAR) - update to 41.0.1
rh-python38-python-setuptools (Red Hat package) - update to 41.6.0-8.el7
dev-python/cryptography - update to 42.0.4
python39-setuptools-wheel - update to 50.3.2-5
python39-setuptools - update to 50.3.2-5

• https://github.com/pyca/cryptography/security/advisories/GHSA-w7pp-m8wf-vj6r
• https://github.com/pyca/cryptography/pull/8230/commits/94a50a9731f35405f0357fa5f3b177d46a726ab3

• Security restrictions bypass in python-cryptography
• IBM z/Transaction Processing Facility update for Apache Kafka
• SUSE update for python-cryptography
• SUSE update for python-cryptography
• Multiple vulnerabilities in IBM Spectrum Protect Plus File Systems Agent
• SUSE update for python-cffi
• SUSE update for python-cffi
• SUSE update for python-cffi
• Error handling in IBM Cloud Pak for Data System
• SUSE update for python-cryptography
• Multiple vulnerabilities in IBM Watson Knowledge Catalog for IBM Cloud Pak for Data
• SUSE update for python-cryptography
• Multiple vulnerabilities in IBM Cloud Pak for Network Automation
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Security Edge Protection Proxy
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Network Exposure Function
• Error handling in IBM Watson Discovery Cartridge for IBM Cloud Pak for Data
• SUSE update for python-cryptography
• SUSE update for python-cryptography
• SUSE update for python-cryptography
• Error handling in IBM Cloud Pak for Security (CP4S)
• Multiple vulnerabilities in IBM Spectrum Discover
• Multiple vulnerabilities in Oracle Solaris third-party software
• Error handling in IBM Decision Optimization for Cloud Pak for Data
• Error handling in IBM Watson Assistant for IBM Cloud Pak for Data
• Splunk SOAR update for Cryptography Python package
• Multiple vulnerabilities in Oracle Database Server
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Network Repository Function
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Binding Support Function
• Multiple vulnerabilities in PeopleSoft Enterprise PeopleTools
• Fedora 39 update for python-cryptography
• Fedora 36 update for python-cryptography
• Fedora 37 update for python-cryptography
• Fedora 38 update for python-cryptography
• Multiple vulnerabilities in Dell PowerStore Family
• Multiple vulnerabilities in Red Hat Ansible Automation Platform 2.4 for RHEL 9
• Multiple vulnerabilities in Red Hat Ansible Automation Platform 2.4 for RHEL 9
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Network Function Cloud Native Environment
• Red Hat Enterprise Linux 9 update for python-cryptography
• Red Hat Software Collections update for rh-python38-python
• Multiple vulnerabilities in Oracle Linux
• Red Hat Enterprise Linux 8 update for python-cryptography
• Multiple vulnerabilities in Red Hat Quay
• Multiple vulnerabilities in IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
• Ubuntu update for python-cryptography
• Multiple vulnerabilities in IBM Data Replication on Cloud Pak for Data
• Multiple vulnerabilities in IBM Storage Sentinel Anomaly Scan Engine
• Multiple vulnerabilities in Oracle Business Intelligence Enterprise Edition
• Multiple vulnerabilities in IBM Cloud Pak for Multicloud Management
• openEuler 20.03 LTS SP1 update for python-cryptography
• openEuler 22.03 LTS update for python-cryptography
• openEuler 20.03 LTS SP3 update for python-cryptography
• openEuler 22.03 LTS SP1 update for python-cryptography
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in Juniper Cloud Native Router
• Multiple vulnerabilities in Juniper Networks Junos cRPD
• Red Hat Enterprise Linux 8 update for the python39:3.9 and python39-devel:3.9 modules
• Multiple vulnerabilities in Dell PowerScale OneFS
• Gentoo update for cryptography
• Error handling in IBM PowerVC
• Multiple vulnerabilities in Dell ObjectScale
• Multiple vulnerabilities in IBM App Connect Enterprise Certified Container
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.16
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.17
• Multiple vulnerabilities in IBM QRadar Deployment Intelligence App
• Amazon Linux AMI update for python-cryptography
• Anolis OS update for python-cryptography
• Anolis OS update for python-cryptography
• Anolis OS update for python39:3.9 module
• Dell SmartFabric Storage Software update for third-party components
• Multiple vulnerabilities in Dell PowerProtect Data Manager
• Dell RecoverPoint for Virtual Machines update for third-party components