{"action":"Upgrade cryptography to 39.0.1 or later.","affected":[{"fixed":"39.0.1","introduced":"1.8"}],"component":"cryptography","cve_ids":["CVE-2023-23931"],"ecosystem":"PyPI","epss":0.01301,"exploited":false,"fixed_versions":["39.0.1"],"ghsa_id":"GHSA-w7pp-m8wf-vj6r","id":"tcs_01M5KG1PW7425RM3C7PB76ZWXY","modified_at":"2026-09-10T03:49:52.124485319Z","published_at":"2023-02-07T20:54:10Z","references":["https://osv.dev/vulnerability/GHSA-w7pp-m8wf-vj6r","https://github.com/pyca/cryptography/security/advisories/GHSA-w7pp-m8wf-vj6r","https://nvd.nist.gov/vuln/detail/CVE-2023-23931","https://github.com/pyca/cryptography/pull/8230","https://github.com/pyca/cryptography/commit/d6951dca25de45abd52da51b608055371fbcde4e","https://github.com/pyca/cryptography","https://github.com/pypa/advisory-database/tree/main/vulns/cryptography/PYSEC-2023-11.yaml","https://lists.debian.org/debian-lts-announce/2024/10/msg00012.html","https://security.netapp.com/advisory/ntap-20230324-0007"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-w7pp-m8wf-vj6r","url":"https://osv.dev/vulnerability/GHSA-w7pp-m8wf-vj6r"}],"summary":"Cipher.update_into can corrupt memory if passed an immutable python object as the outbuf"}