CVE-2023-50782
Python Cryptography package vulnerable to Bleichenbacher timing oracle attack
Reported by redhat · Published February 5, 2024
python-cryptography is fixed in 42.0.0 (GitHub Packages)
A flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| python-cryptography | GitHub Packages | 42.0.0 |
| cryptography | PyPI | 42.0.0 |
| py3-cassandra-medusa | Wolfi | 0.17.2-r1 |
| kubeflow-pipelines | Chainguard | 2.0.5-r3 |
| py3-cassandra-medusa | Chainguard | 0.17.2-r1 |
| kubeflow-pipelines | Wolfi | 2.0.5-r3 |
| ggshield | Wolfi | 1.25.0-r0 |
| airflow | Chainguard | 2.10.5-r44 |
| az | Wolfi | 2.57.0-r0 |
| airflow | Wolfi | 2.10.5-r44 |
| mitmproxy | Wolfi | 12.2.1-r0 |
| mitmproxy | Chainguard | 12.2.1-r0 |
3 more packages have a fixed version. See every fix in Lookup.
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| 3.2 | ||
| Red Hat | Red Hat Ansible Automation Platform 2 | |
| Red Hat | Red Hat Enterprise Linux 7 | |
| Red Hat | Red Hat Enterprise Linux 8 | |
| Red Hat | Red Hat Enterprise Linux 8 | |
| Red Hat | Red Hat Enterprise Linux 9 | |
| Red Hat | Red Hat Satellite 6 | |
| Red Hat | Red Hat Update Infrastructure 4 for Cloud Providers | |
| wolfi | py3-cassandra-medusa | 0 |
| chainguard | kubeflow-pipelines | 0 |
| 3.2 | ||
| PyPI | cryptography | 0 |
| chainguard | py3-cassandra-medusa | 0 |
| Red Hat | Red Hat Enterprise Linux 8 | |
| wolfi | kubeflow-pipelines | 0 |
| Red Hat | Red Hat Enterprise Linux 7 | |
| Red Hat | Red Hat Ansible Automation Platform 2 | |
| Red Hat | Red Hat Enterprise Linux 9 | |
| Red Hat | Red Hat Update Infrastructure 4 for Cloud Providers | |
| Red Hat | Red Hat Enterprise Linux 8 |
…and 9 more
Timeline
- Feb 5, 2024 CVE Published
- Feb 8, 2024 EPSS Score (30 in total, the first dated here)
- Feb 8, 2024 PoC Published
- Oct 5, 2024 Coalition ESS Score (9 in total, the first dated here)
- Mar 10, 2026 Security Advisory (5 in total, the first dated here)
- Aug 10, 2026 Distribution Patch (2 in total, the first dated here)
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2023-50782
vulnetix vdb fixes CVE-2023-50782Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2023-50782/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- vdb-entryx_refsource_REDHAT
- RHBZ#2254432 issue-trackingx_refsource_REDHAT
- https://www.couchbase.com/alerts/ url
- https://nvd.nist.gov/vuln/detail/CVE-2023-50782 advisory
- https://github.com/advisories/GHSA-3ww4-gg4f-jr7f advisory
- https://github.com/pyca/cryptography/issues/9785 url
- https://github.com/pyca/cryptography url
- https://www.couchbase.com/alerts url