It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-459 advisory.

    cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In     affected versions `Cipher.update_into` would accept Python objects which implement the buffer protocol,     but provide only immutable buffers. This would allow immutable objects (such as `bytes`) to be mutated,     thus violating fundamental rules of Python and resulting in corrupted output. This now correctly raises an     exception. This issue has been present since `update_into` was originally introduced in cryptography 1.8.
    (CVE-2023-23931)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the python-cryptography package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In     affected versions `Cipher.update_into` would accept Python objects which implement the buffer protocol,     but provide only immutable buffers. This would allow immutable objects (such as `bytes`) to be mutated,     thus violating fundamental rules of Python and resulting in corrupted output. This now correctly raises an     exception. This issue has been present since `update_into` was originally introduced in cryptography 1.8.
    (CVE-2023-23931)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the python-cryptography package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In     affected versions `Cipher.update_into` would accept Python objects which implement the buffer protocol,     but provide only immutable buffers. This would allow immutable objects (such as `bytes`) to be mutated,     thus violating fundamental rules of Python and resulting in corrupted output. This now correctly raises an     exception. This issue has been present since `update_into` was originally introduced in cryptography 1.8.
    (CVE-2023-23931)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3922 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3922-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                          Adrian Bunk     October 17, 2024                              https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : python-cryptography     Version        : 3.3.2-1+deb11u1     CVE ID         : CVE-2023-23931 CVE-2023-49083     Debian Bug     : 1031049 1057108

    Two vulnerabilities have been fixed in python-cryptography,     a cryptography library for the Python interpreter.

    CVE-2023-23931

        Memory corruption with immutable objects

    CVE-2023-49083

        NULL dereference when loading PKCS7 certificates

    For Debian 11 bullseye, these problems have been fixed in version     3.3.2-1+deb11u1.

    We recommend that you upgrade your python-cryptography packages.

    For the detailed security status of python-cryptography please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/python-cryptography

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of python-cryptography installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-23931 advisory.

  - cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In     affected versions `Cipher.update_into` would accept Python objects which implement the buffer protocol,     but provide only immutable buffers. This would allow immutable objects (such as `bytes`) to be mutated,     thus violating fundamental rules of Python and resulting in corrupted output. This now correctly raises an     exception. This issue has been present since `update_into` was originally introduced in cryptography 1.8.
    (CVE-2023-23931)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 7.02, has python-cryptography packages installed that are affected by multiple vulnerabilities:

  - cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In     affected versions `Cipher.update_into` would accept Python objects which implement the buffer protocol,     but provide only immutable buffers. This would allow immutable objects (such as `bytes`) to be mutated,     thus violating fundamental rules of Python and resulting in corrupted output. This now correctly raises an     exception. This issue has been present since `update_into` was originally introduced in cryptography 1.8.
    (CVE-2023-23931)

  - cryptography is a package designed to expose cryptographic primitives and recipes to Python developers.
    Calling `load_pem_pkcs7_certificates` or `load_der_pkcs7_certificates` could lead to a NULL-pointer     dereference and segfault. Exploitation of this vulnerability poses a serious risk of Denial of Service     (DoS) for any application attempting to deserialize a PKCS7 blob/certificate. The consequences extend to     potential disruptions in system availability and stability. This vulnerability has been patched in version     41.0.6. (CVE-2023-49083)

  - cryptography is a package designed to expose cryptographic primitives and recipes to Python developers.
    Starting in version 38.0.0 and prior to version 42.0.4, if `pkcs12.serialize_key_and_certificates` is     called with both a certificate whose public key did not match the provided private key and an     `encryption_algorithm` with `hmac_hash` set (via     `PrivateFormat.PKCS12.encryption_builder().hmac_hash(...)`, then a NULL pointer dereference would occur,     crashing the Python process. This has been resolved in version 42.0.4, the first version in which a     `ValueError` is properly raised. (CVE-2024-26130)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2024:0274 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2023-23931:
    cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In     affected versions `Cipher.update_into` would accept Python objects which implement the buffer protocol,     but provide only immutable buffers. This would allow immutable objects (such as `bytes`) to be mutated,     thus violating fundamental rules of Python and resulting in corrupted output. This now correctly raises an     exception. This issue has been present since `update_into` was originally introduced in cryptography 1.8.

    CVE-2023-49083:
    cryptography is a package designed to expose cryptographic primitives and recipes to Python developers.
    Calling `load_pem_pkcs7_certificates` or `load_der_pkcs7_certificates` could lead to a NULL-pointer     dereference and segfault. Exploitation of this vulnerability poses a serious risk of Denial of Service     (DoS) for any application attempting to deserialize a PKCS7 blob/certificate. The consequences extend to     potential disruptions in system availability and stability. This vulnerability has been patched in version     41.0.6.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2023-7257:04 advisory.

    * python-cryptography: memory corruption via immutable objects (CVE-2023-23931)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-2985 advisory.

    - Update to 3.5 to fix CVE-2014-0240 (#1101863)
    - Fix CVE-2014-1858, CVE-2014-1859: #1062009, #1062359
    - Security fix for CVE-2023-27043     Resolves: RHEL-5561

    python3x-pip
    - Fix for CVE-2022-40897     Resolves: RHEL-9764
    - Fix CVE-2023-49083: NULL-dereference when loading PKCS7 certificates [Orabug: 36143834]
    - Fix CVE-2023-23931: Don't allow update_into to mutate immutable objects,
    - Security fix for CVE-2021-43818     Resolves: rhbz#2032569
    - Security fix for CVE-2021-28957     Resolves: rhbz#1941534
    - Fixes CVE-2020-27783 and another vulnerability in the HTML Cleaner
    - Security fix for CVE-2023-32681     Resolves: rhbz#2209469
    - Remove patch for CVE-2015-2296, now included in the upstream release.
    - Backport fix for CVE-2015-2296.
    - Security fix for CVE-2023-43804     Resolves: RHEL-11997
    - Fix for CVE-2021-33503 Catastrophic backtracking in URL authority parser     Resolves: rhbz#1968074

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 7.0. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-7.0 advisory.

  - squashfs_opendir in unsquash-2.c in Squashfs-Tools 4.5 allows Directory Traversal, a different     vulnerability than CVE-2021-40153. A squashfs filesystem that has been crafted to include a symbolic link     and then contents under the same filename in a filesystem can cause unsquashfs to first create the     symbolic link pointing outside the expected directory, and then the subsequent write operation will cause     the unsquashfs process to write through the symbolic link elsewhere in the filesystem. (CVE-2021-41072)

  - An issue was discovered in libexpat before 2.6.3. nextScaffoldPart in xmlparse.c can have an integer     overflow for m_groupSize on 32-bit platforms (where UINT_MAX equals SIZE_MAX). (CVE-2024-45492)

  - Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache     Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers     correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect     infinite timeout which allowed connections to remain open which should have been closed. This issue     affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.0-M1     through 9.0.89. The following versions were EOL at the time the CVE was created but are known to be     affected: 8.5.0 though 8.5.100. Users are recommended to upgrade to version 11.0.0-M21, 10.1.25 or 9.0.90,     which fixes the issue. (CVE-2024-34750)

  - A vulnerability was found in libndp. This flaw allows a local malicious user to cause a buffer overflow in     NetworkManager, triggered by sending a malformed IPv6 router advertisement packet. This issue occurred as     libndp was not correctly validating the route length information. (CVE-2024-5564)

  - Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of     service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of     Service (ReDoS) in package_index.py. (CVE-2022-40897)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
186981	Amazon Linux 2023 : python3-cryptography (ALAS2023-2023-459)	Nessus	Amazon Linux Local Security Checks	12/15/2023	12/11/2024	critical
179106	EulerOS Virtualization 2.9.0 : python-cryptography (EulerOS-SA-2023-2531)	Nessus	Huawei Local Security Checks	7/31/2023	7/31/2023	medium
178085	EulerOS 2.0 SP9 : python-cryptography (EulerOS-SA-2023-2340)	Nessus	Huawei Local Security Checks	7/9/2023	7/9/2023	medium
209185	Debian dla-3922 : python-cryptography-doc - security update	Nessus	Debian Local Security Checks	10/17/2024	10/17/2024	critical
201698	CBL Mariner 2.0 Security Update: python-cryptography (CVE-2023-23931)	Nessus	MarinerOS Local Security Checks	7/3/2024	7/3/2024	medium
242822	NewStart CGSL MAIN 7.02 : python-cryptography Multiple Vulnerabilities (NS-SA-2025-0151)	Nessus	NewStart CGSL Local Security Checks	7/25/2025	7/25/2025	medium
236156	Alibaba Cloud Linux 3 : 0274: python3.11-cryptography (ALINUX3-SA-2024:0274)	Nessus	Alibaba Cloud Linux Local Security Checks	5/14/2025	5/14/2025	critical
293552	MiracleLinux 8 : python-cryptography-3.2.1-6.el8 (AXSA:2023-7257:04)	Nessus	Miracle Linux Local Security Checks	1/20/2026	1/20/2026	medium
197993	Oracle Linux 8 : python39:3.9 / and / python39-devel:3.9 (ELSA-2024-2985)	Nessus	Oracle Linux Local Security Checks	5/28/2024	9/9/2025	high
212124	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-7.0)	Nessus	Misc.	12/6/2024	9/1/2025	medium

Detections

Analytics

Plugins Search

critical

medium

medium

critical

medium

medium

critical

medium

high

medium