GHSA-fxff-wxxv-c2jc

PyPinkSign uses a non-random or static IV for Cipher Block Chaining (CBC) mode in AES encryption

Source: GitHub Advisory Database (reviewed) High CVE-2023-48056

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	pypinksign	<= 0.5.1	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

PyPinkSign v0.5.1 uses a non-random or static IV for Cipher Block Chaining (CBC) mode in AES encryption. This vulnerability can lead to the disclosure of information and communications.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-48056 advisory
https://github.com/bandoche/PyPinkSign/issues/29 web
https://github.com/bandoche/PyPinkSign/commit/e1809ddf6a266e9007e10f0486b462fa7f89a43d web
https://github.com/bandoche/PyPinkSign package
https://github.com/bandoche/PyPinkSign/blob/main/pypinksign/pypinksign.py#L504 web
https://github.com/bandoche/PyPinkSign/blob/main/pypinksign/pypinksign.py#L537 web
https://github.com/pypa/advisory-database/tree/main/vulns/pypinksign/PYSEC-2023-245.yaml web
https://gxx777.github.io/PyPinkSign_v0.5.1_Cryptographic_API_Misuse_Vulnerability.md web