Use of a Broken or Risky Cryptographic Algorithm Affecting pyopenssl package, versions [22.0.0,]


Severity

Recommended
0.0
medium
0
10

CVSS assessment made by Snyk's Security Team

    Threat Intelligence

    EPSS
    0.06% (28th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-PYTHON-PYOPENSSL-6149520
  • published 10 Jan 2024
  • disclosed 9 Jan 2024
  • credit Sverker Eriksson

How to fix?

There is no fixed version for pyOpenSSL.

Overview

Affected versions of this package are vulnerable to Use of a Broken or Risky Cryptographic Algorithm due to an issue in the POLY1305 MAC implementation on PowerPC CPUs. An attacker can corrupt the application state and cause incorrect calculations or potential denial of service by influencing the use of the POLY1305 MAC algorithm.

Note:

This is only exploitable if the attacker has the ability to affect the algorithm's usage and the application relies on non-volatile XMM registers.

CVSS Scores

version 3.1
Expand this section

Snyk

Recommended
5.9 medium
  • Attack Vector (AV)
    Network
  • Attack Complexity (AC)
    High
  • Privileges Required (PR)
    None
  • User Interaction (UI)
    None
  • Scope (S)
    Unchanged
  • Confidentiality (C)
    None
  • Integrity (I)
    None
  • Availability (A)
    High
Expand this section

NVD

6.5 medium
Expand this section

SUSE

6.5 medium
Expand this section

Red Hat

6.5 medium