Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2023:0737-1

Опубликовано: 15 мар. 2023
Источник: suse-cvrf

Описание

Security update for python-cryptography

This update for python-cryptography fixes the following issues:

  • CVE-2023-23931: Fixed a memory corruption inside Cipher.update_into via immutable objects (bsc#1208036).

Список пакетов

Image SLES15-SP1-SAP-Azure-LI-BYOS-Production
python3-cryptography-2.9.2-150100.7.12.1
Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production
python3-cryptography-2.9.2-150100.7.12.1
SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS
python2-cryptography-2.9.2-150100.7.12.1
python3-cryptography-2.9.2-150100.7.12.1
SUSE Linux Enterprise Server 15 SP1-LTSS
python2-cryptography-2.9.2-150100.7.12.1
python3-cryptography-2.9.2-150100.7.12.1
SUSE Linux Enterprise Server for SAP Applications 15 SP1
python2-cryptography-2.9.2-150100.7.12.1
python3-cryptography-2.9.2-150100.7.12.1

Ссылки

Описание

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In affected versions `Cipher.update_into` would accept Python objects which implement the buffer protocol, but provide only immutable buffers. This would allow immutable objects (such as `bytes`) to be mutated, thus violating fundamental rules of Python and resulting in corrupted output. This now correctly raises an exception. This issue has been present since `update_into` was originally introduced in cryptography 1.8.

Затронутые продукты
Image SLES15-SP1-SAP-Azure-LI-BYOS-Production:python3-cryptography-2.9.2-150100.7.12.1
Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production:python3-cryptography-2.9.2-150100.7.12.1
SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:python2-cryptography-2.9.2-150100.7.12.1
SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:python3-cryptography-2.9.2-150100.7.12.1
Ссылки