Moderate: python-cryptography security update
Summary
ALSA-2023:6615: Moderate: python-cryptography security update. Affects python3-cryptography versions < 36.0.1-4.el9. Fixed in 36.0.1-4.el9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The python-cryptography packages contain a Python Cryptographic Authority's (PyCA's) cryptography library, which provides cryptographic primitives and recipes to Python developers. This library is widely used in various applications to implement secure communication, encryption, and decryption functionalities.
Vulnerability Detail
The vulnerability identified in the python-cryptography package is a memory corruption issue that can be exploited through immutable objects. An attacker could potentially craft a malicious input that triggers memory corruption, leading to various security risks such as arbitrary code execution, information disclosure, or denial of service. This vulnerability has been assigned the CVE identifier CVE-2023-23931.
How To Fix
Minimum fixed version
36.0.1-4.el9
This is the first release that contains the fix.
sudo dnf update python3-cryptographyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the python-cryptography package is affected by a memory corruption vulnerability that could have severe security implications. It is crucial to update the package to the latest version to ensure the security of your applications. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for python3-cryptography →
FAQ
The vulnerability could potentially allow an attacker to execute arbitrary code, disclose sensitive information, or cause a denial of service.
To determine if your application is affected, you can use the Vulert Playground at Vulert Scanner. Simply upload your manifest file (e.g., package-lock.json) to check if the vulnerability is present in your dependencies.
At the time of this advisory, there are no known public exploits targeting this specific vulnerability. However, it is crucial to apply the recommended security update to mitigate any potential risks.
Currently, there are no known workarounds for this vulnerability. It is recommended to update the python-cryptography package to the latest version as soon as possible.
The vulnerability was discovered by the security research team and promptly reported to the python-cryptography maintainers. They have released the necessary security update to address the issue.
Related vulnerabilities
Recent vulnerabilities recorded for python3-cryptography.
