CVE-2023-38325

Aliases:GHSA-cf7p-gm2m-833mPYSEC-2023-112ALPINE-CVE-2023-38325CGA-4v6j-wjmp-6547CGA-rm98-37r8-g25r
Advisory lineage Upstream: 0 Downstream: 3
Modified
Published: 14 Jul 2023, 00:00
Last modified:30 Oct 2024, 16:00

Vulnerability Summary

Overall Risk (default)
medium
40/100
CVSS Score
7.5 HIGH
v3.1 (nvd)
EPSS Score
0.73% LOW
1% probability -0.46%
KEV
Not listed
Ransomware
No reports
Public exploits
1 found
Dark Web
Not detected

Timeline

14 Jul 2023, 00:00
Published
Vulnerability first disclosed
30 Oct 2024, 16:00
Last Modified
Vulnerability information updated

Description

The cryptography package before 41.0.2 for Python mishandles SSH certificates that have critical options.

CVSS Metrics

  • v4.0•HIGH•Score: 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
  • v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS Trends

Current EPSS score: 0.73%• Percentile: 53%

Techniques & Countermeasures

  • CWE-295•Improper Certificate Validation

    The product does not validate, or incorrectly validates, a certificate.

Affected Systems

  • alpine•py3-cryptography

    ≥ 40.0.0, < 41.0.2-r0 | ≥ 40.0.0, < 41.0.2-r0

  • chainguard•conda

    < 23.7.2-r1

  • wolfi•conda

    < 23.7.2-r1

  • cryptography.io•cryptography

    ≥ 40.0.0, < 41.0.2

  • PyPI•cryptography

    ≥ 40.0.0, < 41.0.2

References (16)