Oracle Database Server / OML4Py (cryptography) CVEs

CVE	Severity	Published▾	Status	Exploitation	Description
CVE-2022-40896	Medium	2023-07-19	Not applicable	No public exploit	A ReDoS issue was discovered in pygments/lexers/smithy.py in pygments through 2.15.0 via SmithyLexer.
CVE-2023-38325	High	2023-07-14	Not applicable	Proof of concept only	The cryptography package before 41.0.2 for Python mishandles SSH certificates that have critical options.
CVE-2023-23931	Medium	2023-02-07	Not applicable	Proof of concept only	cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In affected versions `Cipher.update_into` would accept Python objects which implement the buffer protocol, but provide only immutable buffers. This would allow immutable objects (such as `bytes`) to be mutated, thus violating fundamental rules of Python and resulting in corrupted output. This now correctly raises an exception. This issue has been present since `update_into` was originally introduced in cryptography 1.8.
CVE-2022-40897	Medium	2022-12-23	Not applicable	No public exploit	Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.
CVE-2022-23491	High	2022-12-07	Outside Waratek scope	No public exploit	Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi 2022.12.07 removes root certificates from "TrustCor" from the root store. These are in the process of being removed from Mozilla's trust store. TrustCor's root certificates are being removed pursuant to an investigation prompted by media reporting that TrustCor's ownership also operated a business that produced spyware. Conclusions of Mozilla's investigation can be found in the linked google group discussion.

CVE

Severity

Published▾

Status

Exploitation

Description

CVE-2022-40896

Medium

2023-07-19

Not applicable

No public exploit

A ReDoS issue was discovered in pygments/lexers/smithy.py in pygments through 2.15.0 via SmithyLexer.

CVE-2023-38325

High

2023-07-14

Not applicable

Proof of concept only

The cryptography package before 41.0.2 for Python mishandles SSH certificates that have critical options.

CVE-2023-23931

Medium

2023-02-07

Not applicable

Proof of concept only

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In affected versions `Cipher.update_into` would accept Python objects which implement the buffer protocol, but provide only immutable buffers. This would allow immutable objects (such as `bytes`) to be mutated, thus violating fundamental rules of Python and resulting in corrupted output. This now correctly raises an exception. This issue has been present since `update_into` was originally introduced in cryptography 1.8.

CVE-2022-40897

Medium

2022-12-23

Not applicable

No public exploit

Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.

CVE-2022-23491

High

2022-12-07

Outside Waratek scope

No public exploit

Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi 2022.12.07 removes root certificates from "TrustCor" from the root store. These are in the process of being removed from Mozilla's trust store. TrustCor's root certificates are being removed pursuant to an investigation prompted by media reporting that TrustCor's ownership also operated a business that produced spyware. Conclusions of Mozilla's investigation can be found in the linked google group discussion.