Use of a Broken or Risky Cryptographic Algorithm Affecting cryptography package, versions [35.0.0,42.0.2)
Threat Intelligence
EPSS
0.06% (28th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-CRYPTOGRAPHY-6149518
- published 10 Jan 2024
- disclosed 9 Jan 2024
- credit Sverker Eriksson
Introduced: 9 Jan 2024
CVE-2023-6129 Open this link in a new tabHow to fix?
Upgrade cryptography to version 42.0.2 or higher.
Overview
Affected versions of this package are vulnerable to Use of a Broken or Risky Cryptographic Algorithm due to an issue in the POLY1305 MAC implementation on PowerPC CPUs. An attacker can corrupt the application state and cause incorrect calculations or potential denial of service by influencing the use of the POLY1305 MAC algorithm.
Note:
This is only exploitable if the attacker has the ability to affect the algorithm's usage and the application relies on non-volatile XMM registers.
CVSS Scores
version 3.1