GHSA-fxff-wxxv-c2jc
First published: Thu Nov 16 2023(Updated: )
PyPinkSign v0.5.1 uses a non-random or static IV for Cipher Block Chaining (CBC) mode in AES encryption. This vulnerability can lead to the disclosure of information and communications.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| pip/pypinksign | <=0.5.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2023-48056
- https://gxx777.github.io/PyPinkSign_v0.5.1_Cryptographic_API_Misuse_Vulnerability.md
- http://bandoche.com
- http://pypinksign.com
- https://github.com/bandoche/PyPinkSign/issues/29
- https://github.com/bandoche/PyPinkSign/commit/e1809ddf6a266e9007e10f0486b462fa7f89a43d
- https://github.com/bandoche/PyPinkSign/blob/main/pypinksign/pypinksign.py#L504
- https://github.com/bandoche/PyPinkSign/blob/main/pypinksign/pypinksign.py#L537
- https://github.com/pypa/advisory-database/tree/main/vulns/pypinksign/PYSEC-2023-245.yaml
- https://github.com/advisories/GHSA-fxff-wxxv-c2jc (Advisory)
Frequently Asked Questions
What is the vulnerability ID for PyPinkSign v0.5.1?
The vulnerability ID for PyPinkSign v0.5.1 is GHSA-fxff-wxxv-c2jc.
What is the impact of the vulnerability in PyPinkSign v0.5.1?
The vulnerability in PyPinkSign v0.5.1 can lead to the disclosure of information and communications.
What is the affected software version of PyPinkSign?
PyPinkSign v0.5.1 is the affected software version.
What is the vulnerability description for PyPinkSign v0.5.1?
PyPinkSign v0.5.1 uses a non-random or static IV for Cipher Block Chaining (CBC) mode in AES encryption.
What is the reference for more information about the vulnerability in PyPinkSign v0.5.1?
For more information about the vulnerability in PyPinkSign v0.5.1, you can refer to the following sources: [CVE-2023-48056](https://nvd.nist.gov/vuln/detail/CVE-2023-48056), [PyPinkSign_v0.5.1_Cryptographic_API_Misuse_Vulnerability](https://gxx777.github.io/PyPinkSign_v0.5.1_Cryptographic_API_Misuse_Vulnerability.md), [bandoche.com](http://bandoche.com).
- collector/github-advisory-latest
- alias/GHSA-fxff-wxxv-c2jc
- alias/CVE-2023-48056
- collector/github-advisory
- agent/references
- agent/weakness
- agent/severity
- agent/tags
- agent/type
- agent/event
- agent/description
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- package-manager/pip