CVE-2023-23931: Cipher.update_into can corrupt memory in pyca cryptography

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-02-07 · updated 2026-06-17
Weakness: CWE-754

Description

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In affected versions `Cipher.update_into` would accept Python objects which implement the buffer protocol, but provide only immutable buffers. This would allow immutable objects (such as `bytes`) to be mutated, thus violating fundamental rules of Python and resulting in corrupted output. This now correctly raises an exception. This issue has been present since `update_into` was originally introduced in cryptography 1.8.

Affected products

pyca cryptography: from 1.8 before 39.0.1 — fixed in 39.0.1
Pypi Cryptography: from 1.8 before 39.0.1; 1.8, 1.8.1, 1.8.2, 1.9, 2.0, 2.0.1 (+55) — fixed in 39.0.1

How to fix

Upgrade to a fixed version: pyca cryptography 39.0.1; Pypi Cryptography 39.0.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-23931 or the next vulnerability affects your stack