PyPI/pypinksign CVE-2023-48056: high 7.5, EPSS 0.41%
PyPinkSign v0.5.1 uses a non-random or static IV for Cipher Block Chaining (CBC) mode in AES encryption. This vulnerability can lead to the disclosure of information and communications.
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | - |
Fixed versions
No fixed version in the source.
Sources
- osv: PYSEC-2023-245
- http://bandoche.com
- http://pypinksign.com
- https://gxx777.github.io/PyPinkSign_v0.5.1_Cryptographic_API_Misuse_Vulnerability.md
- https://github.com/advisories/GHSA-fxff-wxxv-c2jc
CVE-2023-48056 · published · modified · JSON