Observable discrepancy in python-cryptography - CVE-2023-50782

Vulnerability identifier: #VU88199

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-50782

CWE-ID: CWE-203

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application. A remote attacker can decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data.

python-cryptography
PowerStore 1200T
PowerStore 1000T
PowerStore 9200T
PowerStore 9000T
PowerStore 3000T
PowerStore 3200T
PowerStore 5000T
PowerStore 500T
PowerStore 5200T
PowerStore 7000T
PowerStoreT OS
Cloud Pak for Security (CP4S)
IBM Qradar SIEM
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
openSUSE Leap Micro
SUSE Enterprise Storage
SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security
SUSE Linux Enterprise Server 12 SP5 LTSS
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP3 LTSS
SUSE Linux Enterprise Server 15 SP4 LTSS
SUSE Linux Enterprise Desktop 15 SP4 LTSS
Basesystem Module
Development Tools Module
Legacy Module
openSUSE Leap
Ubuntu
openEuler
APEX Cloud Platform for Microsoft Azure
PowerVault ME5
Truststore Manager
Storage Defender – Data Protect
Storage Virtualize Ansible Collection
Netezza Performance Server Replication Services
DB2 Warehouse on Cloud Pak for Data
DB2 on Cloud Pak for Data
Storage Resource Manager
SOAR QRadar Plugin App
Storage Protect Plus File Systems Agent
IBM Netezza for Cloud Pak for Data
EMC Cloud Tiering Appliance
QRadar Suite
IBM Process Mining
PowerVC
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
IBM Maximo Application Suite
PowerProtect Data Manager
Dell EMC VxRail Appliance
python3-cryptography (Ubuntu package)
python-cryptography (Ubuntu package)
openssl-1_1-debuginfo
openssl-1_1
libopenssl1_1
libopenssl1_1-hmac
openssl-1_1-debugsource
libopenssl1_1-debuginfo
libopenssl1_1-debuginfo-32bit
libopenssl1_1-hmac-32bit
libopenssl1_1-32bit
openssl-1_1-doc
libopenssl-1_1-devel
libopenssl1_1-32bit-debuginfo
libopenssl-1_1-devel-32bit
libopenssl1_1-64bit-debuginfo
libopenssl1_1-64bit
libopenssl-1_1-devel-64bit
libopenssl1_1-hmac-64bit
libopenssl-3-devel
openssl-3
openssl-3-debuginfo
libopenssl3
openssl-3-debugsource
libopenssl3-debuginfo
libopenssl-3-devel-32bit
libopenssl3-32bit
openssl-3-doc
libopenssl3-32bit-debuginfo
libopenssl-3-devel-64bit
libopenssl3-64bit
libopenssl3-64bit-debuginfo
libopenssl-3-fips-provider-32bit-debuginfo
libopenssl-3-fips-provider-32bit
libopenssl-3-fips-provider-64bit
libopenssl-3-fips-provider-64bit-debuginfo
libopenssl-3-fips-provider
libopenssl-3-fips-provider-debuginfo
python-cryptography-help
python-cryptography
python-cryptography-debuginfo
python-cryptography-debugsource
python2-cryptography
python3-cryptography
Planning Analytics Local
Dell EMC Storage Monitoring and Reporting (SMR)

Install updates from vendor's website.

python-cryptography - update to 42.0.0
APEX Cloud Platform for Microsoft Azure - update to 01.04.00.00
QRadar Suite - update to 1.10.20.0
IBM Process Mining - update to 1.14.4
PowerVC - addressed in versions 2.2.1.2, 2.3.0
Dell EMC VxRail Appliance - addressed in versions 7.0.533, 8.320
python3-cryptography (Ubuntu package) - addressed in versions Ubuntu Pro, 2.8-3ubuntu0.3, 3.4.8-1ubuntu2.2, 38.0.4-4ubuntu0.23.10.2
python-cryptography (Ubuntu package) - addressed in versions Ubuntu Pro, 2.8-3ubuntu0.3
openssl-1_1-debuginfo - addressed in versions 1.1.1d-2.113.1, 1.1.1d-150200.11.97.1, 1.1.1l-150400.7.75.1, 1.1.1l-150500.17.37.1, 1.1.1w-150600.5.9.1
openssl-1_1 - addressed in versions 1.1.1d-2.113.1, 1.1.1d-150200.11.97.1, 1.1.1l-150400.7.75.1, 1.1.1l-150500.17.37.1, 1.1.1w-150600.5.9.1
libopenssl1_1 - addressed in versions 1.1.1d-2.113.1, 1.1.1d-150200.11.97.1, 1.1.1l-150400.7.75.1, 1.1.1l-150500.17.37.1, 1.1.1w-150600.5.9.1
libopenssl1_1-hmac - addressed in versions 1.1.1d-2.113.1, 1.1.1d-150200.11.97.1, 1.1.1l-150400.7.75.1, 1.1.1l-150500.17.37.1
openssl-1_1-debugsource - addressed in versions 1.1.1d-2.113.1, 1.1.1d-150200.11.97.1, 1.1.1l-150400.7.75.1, 1.1.1l-150500.17.37.1, 1.1.1w-150600.5.9.1
libopenssl1_1-debuginfo - addressed in versions 1.1.1d-2.113.1, 1.1.1d-150200.11.97.1, 1.1.1l-150400.7.75.1, 1.1.1l-150500.17.37.1, 1.1.1w-150600.5.9.1
libopenssl1_1-debuginfo-32bit - update to 1.1.1d-2.113.1
libopenssl1_1-hmac-32bit - addressed in versions 1.1.1d-2.113.1, 1.1.1d-150200.11.97.1, 1.1.1l-150400.7.75.1, 1.1.1l-150500.17.37.1
libopenssl1_1-32bit - addressed in versions 1.1.1d-2.113.1, 1.1.1d-150200.11.97.1, 1.1.1l-150400.7.75.1, 1.1.1l-150500.17.37.1, 1.1.1w-150600.5.9.1
openssl-1_1-doc - addressed in versions 1.1.1d-150200.11.97.1, 1.1.1l-150500.17.37.1, 1.1.1w-150600.5.9.1
libopenssl-1_1-devel - addressed in versions 1.1.1d-150200.11.97.1, 1.1.1l-150400.7.75.1, 1.1.1l-150500.17.37.1, 1.1.1w-150600.5.9.1
libopenssl1_1-32bit-debuginfo - addressed in versions 1.1.1d-150200.11.97.1, 1.1.1l-150400.7.75.1, 1.1.1l-150500.17.37.1, 1.1.1w-150600.5.9.1
libopenssl-1_1-devel-32bit - addressed in versions 1.1.1d-150200.11.97.1, 1.1.1l-150400.7.75.1, 1.1.1l-150500.17.37.1, 1.1.1w-150600.5.9.1
libopenssl1_1-64bit-debuginfo - addressed in versions 1.1.1l-150500.17.37.1, 1.1.1w-150600.5.9.1
libopenssl1_1-64bit - addressed in versions 1.1.1l-150500.17.37.1, 1.1.1w-150600.5.9.1
libopenssl-1_1-devel-64bit - addressed in versions 1.1.1l-150500.17.37.1, 1.1.1w-150600.5.9.1
libopenssl1_1-hmac-64bit - update to 1.1.1l-150500.17.37.1
PowerVault ME5 - update to 1.2.1.0
Truststore Manager - update to 1.5.3
Planning Analytics Local - addressed in versions 2.0.0.96, 2.1.3
Storage Defender – Data Protect - update to 2.0.2
Storage Virtualize Ansible Collection - update to 2.3.0
Netezza Performance Server Replication Services - update to 3.0.5.1
libopenssl-3-devel - addressed in versions 3.0.8-150400.4.69.1, 3.0.8-150500.5.48.1, 3.1.4-150600.5.21.1
openssl-3 - addressed in versions 3.0.8-150400.4.69.1, 3.0.8-150500.5.48.1, 3.1.4-150600.5.21.1
openssl-3-debuginfo - addressed in versions 3.0.8-150400.4.69.1, 3.0.8-150500.5.48.1, 3.1.4-150600.5.21.1
libopenssl3 - addressed in versions 3.0.8-150400.4.69.1, 3.0.8-150500.5.48.1, 3.1.4-150600.5.21.1
openssl-3-debugsource - addressed in versions 3.0.8-150400.4.69.1, 3.0.8-150500.5.48.1, 3.1.4-150600.5.21.1
libopenssl3-debuginfo - addressed in versions 3.0.8-150400.4.69.1, 3.0.8-150500.5.48.1, 3.1.4-150600.5.21.1
libopenssl-3-devel-32bit - addressed in versions 3.0.8-150500.5.48.1, 3.1.4-150600.5.21.1
libopenssl3-32bit - addressed in versions 3.0.8-150500.5.48.1, 3.1.4-150600.5.21.1
openssl-3-doc - addressed in versions 3.0.8-150500.5.48.1, 3.1.4-150600.5.21.1
libopenssl3-32bit-debuginfo - addressed in versions 3.0.8-150500.5.48.1, 3.1.4-150600.5.21.1
libopenssl-3-devel-64bit - addressed in versions 3.0.8-150500.5.48.1, 3.1.4-150600.5.21.1
libopenssl3-64bit - addressed in versions 3.0.8-150500.5.48.1, 3.1.4-150600.5.21.1
libopenssl3-64bit-debuginfo - addressed in versions 3.0.8-150500.5.48.1, 3.1.4-150600.5.21.1
libopenssl-3-fips-provider-32bit-debuginfo - update to 3.1.4-150600.5.21.1
libopenssl-3-fips-provider-32bit - update to 3.1.4-150600.5.21.1
libopenssl-3-fips-provider-64bit - update to 3.1.4-150600.5.21.1
libopenssl-3-fips-provider-64bit-debuginfo - update to 3.1.4-150600.5.21.1
libopenssl-3-fips-provider - update to 3.1.4-150600.5.21.1
libopenssl-3-fips-provider-debuginfo - update to 3.1.4-150600.5.21.1
python-cryptography-help - addressed in versions 3.3.1-6, 36.0.1-7, 36.0.1-8, 42.0.2-8
python-cryptography - addressed in versions 3.3.1-6, 36.0.1-7, 36.0.1-8, 42.0.2-8
python-cryptography-debuginfo - addressed in versions 3.3.1-6, 36.0.1-7, 36.0.1-8, 42.0.2-8
python-cryptography-debugsource - addressed in versions 3.3.1-6, 36.0.1-7, 36.0.1-8, 42.0.2-8
python2-cryptography - update to 3.3.1-6
python3-cryptography - addressed in versions 3.3.1-6, 36.0.1-7, 36.0.1-8, 42.0.2-8
PowerStoreT OS - update to 3.6.1.5-2456810
DB2 Warehouse on Cloud Pak for Data - update to 4.8.5
DB2 on Cloud Pak for Data - update to 4.8.5
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 4.8.5
Storage Resource Manager - update to 5.0.1.0
Dell EMC Storage Monitoring and Reporting (SMR) - update to 5.0.1.0
SOAR QRadar Plugin App - update to 5.4.0
IBM Qradar SIEM - update to 7.5.0 Update Pack 10 IF01
IBM Maximo Application Suite - addressed in versions 8.10.10, 8.11.7
Storage Protect Plus File Systems Agent - update to 10.1.16.1
IBM Netezza for Cloud Pak for Data - update to 11.2.3.3
EMC Cloud Tiering Appliance - update to 13.2.0.2.32
PowerProtect Data Manager - update to 19.19.0-15

• https://access.redhat.com/security/cve/CVE-2023-50782
• https://bugzilla.redhat.com/show_bug.cgi?id=2254432

• Ubuntu update for python-cryptography
• Ubuntu update for python-cryptography
• Multiple vulnerabilities in IBM Storage Defender - Resiliency Service
• Multiple vulnerabilities in IBM Storage Protect Plus File Systems Agent
• Observable discrepancy in IBM Process Mining
• Multiple vulnerabilities in IBM QRadar Suite Software
• Observable discrepancy in IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM SOAR QRadar Plugin App
• Multiple vulnerabilities in IBM Db2 on Cloud Pak for Data, and Db2 Warehouse on Cloud Pak for Data
• Observable discrepancy in IBM Maximo Application Suite
• Multiple vulnerabilities in IBM Planning Analytics Local - IBM Planning Analytics Workspace
• Observable discrepancy in IBM Storage Virtualize Ansible Collection
• Multiple vulnerabilities in Dell PowerVault ME5
• Multiple vulnerabilities in Dell Storage Resource Manager (SRM) and Dell Storage Monitoring and Reporting (SMR)
• SUSE update for openssl-1_1
• SUSE update for openssl-1_1
• SUSE update for openssl-3
• SUSE update for openssl-3
• SUSE update for openssl-1_1
• Multiple vulnerabilities in IBM QRadar SIEM
• SUSE update for openssl-1_1
• SUSE update for openssl-1_1
• SUSE update for openssl-3
• Multiple vulnerabilities in Dell Cloud Tiering Appliance
• Multiple vulnerabilities in IBM Netezza for Cloud Pak for Data (on Cloud)
• Multiple vulnerabilities in Dell VxRail Appliance
• Multiple vulnerabilities in Dell VxRail Appliance 7.x
• APEX Cloud Platform for Microsoft Azure update for third-party components
• Multiple vulnerabilities in Dell PowerProtect Data Manager
• Multiple vulnerabilities in Dell PowerStoreT OS
• Multiple vulnerabilities in IBM PowerVC
• openEuler 24.03 LTS SP1 update for python-cryptography
• openEuler 22.03 LTS SP3 update for python-cryptography
• openEuler 20.03 LTS SP4 update for python-cryptography
• openEuler 24.03 LTS SP2 update for python-cryptography
• openEuler 24.03 LTS update for python-cryptography
• openEuler 22.03 LTS SP4 update for python-cryptography
• Multiple vulnerabilities in IBM Netezza Performance Server Replication Services