Amazon Linux 2023 Security Advisory: ALAS-2023-459
Advisory Release Date: 2023-12-06 07:46 Pacific
Advisory Updated Date: 2023-12-14 21:42 Pacific
Severity:
Medium
Issue Overview:
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In affected versions `Cipher.update_into` would accept Python objects which implement the buffer protocol, but provide only immutable buffers. This would allow immutable objects (such as `bytes`) to be mutated, thus violating fundamental rules of Python and resulting in corrupted output. This now correctly raises an exception. This issue has been present since `update_into` was originally introduced in cryptography 1.8. (CVE-2023-23931)
Affected Packages:
python-cryptography
Issue Correction:
Run dnf update python-cryptography --releasever 2023.3.20231211 to update your system.
New Packages:
aarch64:
python3-cryptography-debuginfo-36.0.1-1.amzn2023.0.4.aarch64
python-cryptography-debugsource-36.0.1-1.amzn2023.0.4.aarch64
python3-cryptography-36.0.1-1.amzn2023.0.4.aarch64
src:
python-cryptography-36.0.1-1.amzn2023.0.4.src
x86_64:
python3-cryptography-debuginfo-36.0.1-1.amzn2023.0.4.x86_64
python-cryptography-debugsource-36.0.1-1.amzn2023.0.4.x86_64
python3-cryptography-36.0.1-1.amzn2023.0.4.x86_64