Critical Vulnerability in Python-Cryptography Package: Buffer Protocol Violation
Summary
UBUNTU-CVE-2023-23931: cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Affects python-cryptography versions 1.9-1 – 2.1.4-1ubuntu1.4+esm1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The python-cryptography package is a widely used library in Python that provides cryptographic primitives and recipes for developers. It is essential for secure data transmission and storage, enabling functionalities such as encryption, decryption, and secure hashing. This package is integral to many applications that require secure communication and data integrity. However, certain versions of this package are vulnerable to a significant issue that can lead to data corruption.
Vulnerability Detail
The vulnerability arises from the Cipher.update_into method in the cryptography package, which incorrectly accepts immutable Python objects that implement the buffer protocol. This flaw allows these immutable objects, such as bytes, to be mutated, violating Python's fundamental rules and potentially leading to corrupted output. This issue has existed since the introduction of the update_into method in version 1.8 of the cryptography package. The vulnerability is classified with a CVSS score of 4.8, indicating a moderate severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the update_into method with immutable objects until the package is updated. Instead, consider using mutable objects or alternative methods for handling cryptographic operations that do not involve this vulnerability.
Conclusion
The python-cryptography package has a critical vulnerability that can lead to data corruption due to improper handling of immutable objects. It is essential to update to the latest patched versions to mitigate this risk. Utilizing tools like Vulert can further enhance security by monitoring for vulnerabilities in real-time.
See every vulnerability recorded for python-cryptography →
FAQ
The vulnerability allows immutable objects to be mutated when using the Cipher.update_into method, leading to potential data corruption.
You can use the Vulert playground at Vulert Scanner to check if your application is affected without needing to sign up.
Failing to address this vulnerability may result in corrupted data outputs, which can compromise the integrity and security of applications relying on the cryptography package.
Yes, patched versions of the python-cryptography package are available for various Ubuntu distributions. It is recommended to update to the latest version.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in software using a manifest file. It helps developers maintain secure applications by providing real-time alerts.
Related vulnerabilities
Recent vulnerabilities recorded for python-cryptography.
