<feed xmlns='http://www.w3.org/2005/Atom'>
<title>linux/poky.git/meta/recipes-devtools/python/python3-cryptography/CVE-2023-23931.patch, branch kirkstone-4.0.25</title>
<subtitle>Mirror of git.yoctoproject.org/poky</subtitle>
<id>https://git.enea.com/cgit/linux/poky.git/atom?h=kirkstone-4.0.25</id>
<link rel='self' href='https://git.enea.com/cgit/linux/poky.git/atom?h=kirkstone-4.0.25'/>
<link rel='alternate' type='text/html' href='https://git.enea.com/cgit/linux/poky.git/'/>
<updated>2023-05-10T14:19:56+00:00</updated>
<entry>
<title>python3-cryptography: fix for CVE-2023-23931</title>
<updated>2023-05-10T14:19:56+00:00</updated>
<author>
<name>Narpat Mali</name>
<email>narpat.mali@windriver.com</email>
</author>
<published>2023-05-05T16:53:53+00:00</published>
<link rel='alternate' type='text/html' href='https://git.enea.com/cgit/linux/poky.git/commit/?id=1367249c996394668eaf97404874d7d13225a53d'/>
<id>urn:sha1:1367249c996394668eaf97404874d7d13225a53d</id>
<content type='text'>
cryptography is a package designed to expose cryptographic primitives
and recipes to Python developers. In affected versions `Cipher.update_into`
would accept Python objects which implement the buffer protocol, but
provide only immutable buffers. This would allow immutable objects
(such as `bytes`) to be mutated, thus violating fundamental rules of
Python and resulting in corrupted output. This now correctly raises
an exception. This issue has been present since `update_into` was
originally introduced in cryptography 1.8.

(From OE-Core rev: 368e450c2d800790a05924519f34c579e28e9cbb)

Signed-off-by: Narpat Mali &lt;narpat.mali@windriver.com&gt;
Signed-off-by: Steve Sakoman &lt;steve@sakoman.com&gt;
</content>
</entry>
</feed>
