VYPR
← All advisories
Moderate severityNVD Advisory· Published Feb 7, 2023· Updated Nov 3, 2025

Cipher.update_into can corrupt memory in pyca cryptography

CVE-2023-23931

Description

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In affected versions Cipher.update_into would accept Python objects which implement the buffer protocol, but provide only immutable buffers. This would allow immutable objects (such as bytes) to be mutated, thus violating fundamental rules of Python and resulting in corrupted output. This now correctly raises an exception. This issue has been present since update_into was originally introduced in cryptography 1.8.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Cryptography library's `Cipher.update_into` allowed mutation of immutable buffers (e.g., bytes), violating Python rules and causing corrupted output.

Vulnerability

CVE-2023-23931 affects the cryptography Python library, specifically the Cipher.update_into method. The method incorrectly accepted Python objects that implement the buffer protocol but provide only immutable buffers, such as bytes. This allowed the method to mutate these immutable objects, violating Python's fundamental rules and leading to corrupted cryptographic output. The issue has existed since update_into was introduced in cryptography 1.8 [1][2].

Exploitation

An attacker could exploit this vulnerability by providing an immutable buffer (e.g., a bytes object) to update_into. No special authentication or network position is required; any code path that passes untrusted data to this method could trigger the behavior. The vulnerability is local to the application using the library [1][3].

Impact

Successful exploitation results in the mutation of immutable objects, which can cause corrupted ciphertext or plaintext output. This may lead to data integrity issues, incorrect cryptographic operations, and potential memory corruption in Python due to violation of buffer semantics [1][4].

Mitigation

The fix was released in cryptography version 39.0.1, which properly raises an exception when an immutable buffer is passed to update_into. Users should upgrade to 39.0.1 or later. No workaround is available [3][4].

References
  1. NVD - CVE-2023-23931
  2. advisory-database/vulns/cryptography/PYSEC-2023-11.yaml at main · pypa/advisory-database
  3. changelog + security fix backport (#8231) · pyca/cryptography@d6951dc
  4. Don't allow update_into to mutate immutable objects by alex · Pull Request #8230 · pyca/cryptography

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
cryptographyPyPI
>= 1.8, < 39.0.139.0.1

Affected products

140

Patches

1
d6951dca25de

changelog + security fix backport (#8231)

https://github.com/pyca/cryptographyPaul KehrerFeb 7, 2023via ghsa
commit
5 files changed · +20 −3
  • CHANGELOG.rst+9 −0 modified
    @@ -1,6 +1,15 @@
 Changelog
 =========
 
+.. _v39-0-1:
+
+39.0.1 - 2023-02-07
+~~~~~~~~~~~~~~~~~~~
+
+* **SECURITY ISSUE** - Fixed a bug where ``Cipher.update_into`` accepted Python
+  buffer protocol objects, but allowed immutable buffers. **CVE-2023-23931**
+* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.0.8.
+
 .. _v39-0-0:
 
 39.0.0 - 2023-01-01
  • src/cryptography/__about__.py+1 −1 modified
    @@ -9,7 +9,7 @@
     "__copyright__",
 ]
 
-__version__ = "39.0.0"
+__version__ = "39.0.1"
 
 __author__ = "The Python Cryptographic Authority and individual contributors"
 __copyright__ = "Copyright 2013-2022 {}".format(__author__)
  • src/cryptography/hazmat/backends/openssl/ciphers.py+1 −1 modified
    @@ -156,7 +156,7 @@ def update_into(self, data: bytes, buf: bytes) -> int:
         data_processed = 0
         total_out = 0
         outlen = self._backend._ffi.new("int *")
-        baseoutbuf = self._backend._ffi.from_buffer(buf)
+        baseoutbuf = self._backend._ffi.from_buffer(buf, require_writable=True)
         baseinbuf = self._backend._ffi.from_buffer(data)
 
         while data_processed != total_data_len:
  • tests/hazmat/primitives/test_ciphers.py+8 −0 modified
    @@ -318,6 +318,14 @@ def test_update_into_buffer_too_small(self, backend):
         with pytest.raises(ValueError):
             encryptor.update_into(b"testing", buf)
 
+    def test_update_into_immutable(self, backend):
+        key = b"\x00" * 16
+        c = ciphers.Cipher(AES(key), modes.ECB(), backend)
+        encryptor = c.encryptor()
+        buf = b"\x00" * 32
+        with pytest.raises((TypeError, BufferError)):
+            encryptor.update_into(b"testing", buf)
+
     @pytest.mark.supported(
         only_if=lambda backend: backend.cipher_supported(
             AES(b"\x00" * 16), modes.GCM(b"\x00" * 12)
  • vectors/cryptography_vectors/__about__.py+1 −1 modified
    @@ -6,4 +6,4 @@
     "__version__",
 ]
 
-__version__ = "39.0.0"
+__version__ = "39.0.1"

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

9

News mentions

0

No linked articles in our index yet.