Oh no! Use of Rust did not prevent a "vulnerability"! From ${URL}: Previously, Cipher.update_into would accept Python objects which implement the buffer protocol, but provide only immutable buffers: >>> outbuf = b"\x00" * 32 >>> c = ciphers.Cipher(AES(b"\x00" * 32), modes.ECB()).encryptor() >>> c.update_into(b"\x00" * 16, outbuf) 16 >>> outbuf b'\xdc\x95\xc0x\xa2@\x89\x89\xadH\xa2\x14\x92\x84 \x87\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' This would allow immutable objects (such as bytes) to be mutated, thus violating fundamental rules of Python. This is a soundness bug -- it allows programmers to misuse an API, it cannot be exploited by attacker controlled data alone. This now correctly raises an exception. This issue has been present since update_into was originally introduced in cryptography 1.8.
Thanks!
Can't cleanup because of bug 893522.
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=860a9047ef51635cb4b93e2528b25d923dce8d58 commit 860a9047ef51635cb4b93e2528b25d923dce8d58 Author: Arthur Zamarin <arthurzam@gentoo.org> AuthorDate: 2023-04-21 15:43:44 +0000 Commit: Arthur Zamarin <arthurzam@gentoo.org> CommitDate: 2023-04-21 15:44:26 +0000 dev-python/cryptography: drop 38.0.4 Bug: https://bugs.gentoo.org/893576 Signed-off-by: Arthur Zamarin <arthurzam@gentoo.org> dev-python/cryptography/Manifest | 25 ---- dev-python/cryptography/cryptography-38.0.4.ebuild | 143 --------------------- 2 files changed, 168 deletions(-)
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/data/glsa.git/commit/?id=c64e048a91b0aa0d481f453db2b0de77a5123fc4 commit c64e048a91b0aa0d481f453db2b0de77a5123fc4 Author: GLSAMaker <glsamaker@gentoo.org> AuthorDate: 2024-07-01 05:59:02 +0000 Commit: John Helmert III <ajak@gentoo.org> CommitDate: 2024-07-01 06:09:25 +0000 [ GLSA 202407-06 ] cryptography: Multiple Vulnerabilities Bug: https://bugs.gentoo.org/769419 Bug: https://bugs.gentoo.org/864049 Bug: https://bugs.gentoo.org/893576 Bug: https://bugs.gentoo.org/918685 Bug: https://bugs.gentoo.org/925120 Signed-off-by: GLSAMaker <glsamaker@gentoo.org> Signed-off-by: John Helmert III <ajak@gentoo.org> glsa-202407-06.xml | 49 +++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 49 insertions(+)
