CVE-2023-23931: Cipher.update_into can corrupt memory in pyca cryptography
Vulnerability summary
CVE-2023-23931 is a medium (CVSS 6.5) vulnerability in cryptography.io cryptography. EPSS estimates a 1.30% chance of exploitation in the next 30 days, higher than 70.4% of scored vulnerabilities. 1 public exploit is recorded.
Not severe (CVSS 4.8, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 8 · Related 4Timeline
- 07-02-2023PublishedVulnerability first disclosed.
- 03-11-2025Last modifiedVulnerability information updated.
Description
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In affected versions `Cipher.update_into` would accept Python objects which implement the buffer protocol, but provide only immutable buffers. This would allow immutable objects (such as `bytes`) to be mutated, thus violating fundamental rules of Python and resulting in corrupted output. This now correctly raises an exception. This issue has been present since `update_into` was originally introduced in cryptography 1.8.
CVSS metrics
10 scores · 9 sources · 2 versions- CVE.orgCNA4.8MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:LDiffers
- OSV · AlpineEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
- OSV · PypiEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
- OSV · Red hatEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
- OSV · WolfiEcosystem advisory · calculated4.8MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:LDiffers
- OSV · ChainguardEcosystem advisory · calculated4.8MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:LDiffers
EPSS trend
Probability
1.30%
Chance of exploitation in the next 30 days
Percentile
70%
Versus all other CVEs
30-day change
No change 0.00 pp
From 1.30% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundCryptography
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Suse84 products
- python-cffi&distro=HPE Helion OpenStack 8< 1.10.0-4.3.1
- python-cffi&distro=SUSE Linux Enterprise Server 12 SP5< 1.11.5-5.19.1
- python-cffi&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP5< 1.11.5-5.19.1
- python-cffi&distro=SUSE OpenStack Cloud 8< 1.10.0-4.3.1
- python-cffi&distro=SUSE OpenStack Cloud 9< 1.11.5-3.3.1
Opensuse4 products
- python-cryptography&distro=openSUSE Leap 15.4< 3.3.2-150400.16.6.1
- python-cryptography&distro=openSUSE Leap Micro 5.3< 3.3.2-150400.16.6.1
- python-cryptography&distro=openSUSE Tumbleweed< 39.0.1-1.1
- python-oci-sdk&distro=openSUSE Tumbleweed< 2.180.0-1.2
Redhat4 products
- python-cryptography< 0:36.0.1-4.el9 | < 0:3.2.1-6.el8
- python-cryptography-debugsource< 0:36.0.1-4.el9 | < 0:3.2.1-6.el8
- python3-cryptography< 0:36.0.1-4.el9 | < 0:3.2.1-6.el8
- python3-cryptography-debuginfo< 0:36.0.1-4.el9 | < 0:3.2.1-6.el8
Alpine1 product
- py3-cryptography≥ 1.8, < 38.0.3-r1 | ≥ 1.8, < 39.0.1-r0
Chainguard1 product
- mitmproxy< 12.2.1-r0
Cryptography.io1 product
- cryptography≥ 1.8, < 39.0.1
Debian1 product
- python-cryptography< 2.6.1-3+deb10u3 | < 2.6.1-3+deb10u4 | < 38.0.4-3
Mageia1 product
- python-cryptography< 3.3.1-1.2.mga8
Pyca1 product
- cryptography≥ 1.8, < 39.0.1
PyPI1 product
- cryptography< 94a50a9731f35405f0357fa5f3b177d46a726ab3 | ≥ 1.8, < 39.0.1
Ubuntu1 product
- python-cryptography< 2.1.4-1ubuntu1.4+esm6 | < 2.8-3ubuntu0.2 | < 3.4.8-1ubuntu2.1
Wolfi1 product
- mitmproxy< 12.2.1-r0
12 vendors · 101 products
References
44 links- github.com/pyca/cryptography/security/advisories/GHSA-w7pp-m8wf-vj6rX Refsource CONFIRMWEBEVIDENCEAdvisoryARTICLEREPORTExploitVendor Advisory
- github.com/pyca/cryptography/pull/8230/commits/94a50a9731f35405f0357fa5f3b177d46a726ab3X Refsource MISCFIXREPORTWEBPatch
Show all 44 references
- github.com/pyca/cryptographyPACKAGE