PT-2023-4923 · Pypi+2 · Cryptography+2

Lkubb · Publicado 2023-07-14 · Atualizado 2024-09-18 · CVE-2023-38325

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions cryptography package versions prior to 41.0.2

Description The issue is related to errors in the certificate authentication procedure, which can be exploited by a remote attacker to perform a man-in-the-middle attack. The problem arises from the mishandling of SSH certificates that have critical options.

Recommendations For versions prior to 41.0.2, update to version 41.0.2 or later to resolve the issue.

Exploit

Correção

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

ALT-PU-2023-8071

ALT-PU-2023-8444

ALT-PU-2024-9926

BDU:2023-05436

CVE-2023-38325

GHSA-CF7P-GM2M-833M

OPENSUSE-SU-2024:13078-1

PYSEC-2023-112

Produtos afetados

Alt Linux

Red Os

Cryptography

Referências · 25

• 🔥 https://github.com/pyca/cryptography/issues/9207 · Exploit
• https://github.com/pyca/cryptography · Nota
• https://github.com/pyca/cryptography/pull/9208 · Aviso do Fabricante
• https://github.com/pyca/cryptography/compare/41.0.1...41.0.2 · Correção
• https://github.com/pyca/cryptography/commit/1ca7adc97b76a9dfbd3d850628b613eb93b78fc3 · Nota
• https://github.com/pyca/cryptography/pull/7960 · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/cryptography/PYSEC-2023-112.yaml · Nota
• https://security.alpinelinux.org/vuln/CVE-2023-38325 · Nota
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/NMCCTYY3CSNQBFFYYC5DAV6KATHWCUZK · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-38325 · Nota de Segurança
• https://bdu.fstec.ru/vul/2023-05436 · Nota de Segurança
• https://t.me/cvenotify/93393 · Publicação no Telegram
• https://pypi.org/project/cryptography/#history · Nota
• https://osv.dev/vulnerability/ALPINE-CVE-2023-38325 · Aviso do Fabricante
• https://security.netapp.com/advisory/ntap-20230824-0010 · Nota