-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the Cipher.update_into implementation in ciphers.py. The key evidence is the commit diff adding 'require_writable=True' to ffi.from_buffer() calls for the output buffer. Prior to this fix, the code didn't validate buffer writability, enabling writes to immutable objects like bytes. The added test test_update_into_immutable explicitly verifies this failure scenario. The CWE-754 mapping confirms this was an improper check for exceptional conditions (missing writability validation).
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| cryptography | pip | >= 1.8, < 39.0.1 | 39.0.1 |