GHSA-fxff-wxxv-c2jc

Source

https://github.com/advisories/GHSA-fxff-wxxv-c2jc

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/11/GHSA-fxff-wxxv-c2jc/GHSA-fxff-wxxv-c2jc.json

Aliases

• CVE-2023-48056
• PYSEC-2023-245

Published

2023-11-16T18:30:31Z

Modified

2023-11-22T22:19:16.925358Z

Details

PyPinkSign v0.5.1 uses a non-random or static IV for Cipher Block Chaining (CBC) mode in AES encryption. This vulnerability can lead to the disclosure of information and communications.

References

• https://nvd.nist.gov/vuln/detail/CVE-2023-48056
• https://github.com/bandoche/PyPinkSign/issues/29
• https://github.com/bandoche/PyPinkSign/commit/e1809ddf6a266e9007e10f0486b462fa7f89a43d
• https://github.com/bandoche/PyPinkSign
• https://github.com/bandoche/PyPinkSign/blob/main/pypinksign/pypinksign.py#L504
• https://github.com/bandoche/PyPinkSign/blob/main/pypinksign/pypinksign.py#L537
• https://github.com/pypa/advisory-database/tree/main/vulns/pypinksign/PYSEC-2023-245.yaml
• https://gxx777.github.io/PyPinkSign_v0.5.1_Cryptographic_API_Misuse_Vulnerability.md
• http://bandoche.com
• http://pypinksign.com