CVE-2023-48056

PyPinkSign uses a non-random or static IV for Cipher Block Chaining (CBC) mode in AES encryption

7.5 High

PyPinkSign v0.5.1 uses a non-random or static IV for Cipher Block Chaining (CBC) mode in AES encryption. This vulnerability can lead to the disclosure of information and communications.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

0.41%Up 0.4 points since Nov 17, 2023

What each source reports

NVD Score used 7.5

PyPinkSign v0.5.1 uses a non-random or static IV for Cipher Block Chaining (CBC) mode in AES encryption. This vulnerability can lead to the disclosure of information and communications.

Record: CVE-2023-48056
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-330
Updated: 2026-11-02

CVE List No score

PyPinkSign v0.5.1 uses a non-random or static IV for Cipher Block Chaining (CBC) mode in AES encryption. This vulnerability can lead to the disclosure of information and communications.

Record: CVE-2023-48056
Updated: 2026-11-02

EUVDEUVD-2023-0218 No score

PyPinkSign v0.5.1 uses a non-random or static IV for Cipher Block Chaining (CBC) mode in AES encryption. This vulnerability can lead to the disclosure of information and communications.

Record: EUVD-2023-0218
Updated: 2026-11-02

GitHub AdvisoriesGHSA-fxff-wxxv-c2jc 8.7

PyPinkSign uses a non-random or static IV for Cipher Block Chaining (CBC) mode in AES encryption

PyPinkSign v0.5.1 uses a non-random or static IV for Cipher Block Chaining (CBC) mode in AES encryption. This vulnerability can lead to the disclosure of information and communications.

Record: GHSA-fxff-wxxv-c2jc
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-330
Updated: 2026-11-02

OSVGHSA-fxff-wxxv-c2jc 8.7

PyPinkSign uses a non-random or static IV for Cipher Block Chaining (CBC) mode in AES encryption

PyPinkSign v0.5.1 uses a non-random or static IV for Cipher Block Chaining (CBC) mode in AES encryption. This vulnerability can lead to the disclosure of information and communications.

Record: GHSA-fxff-wxxv-c2jc
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-330
Updated: 2026-11-02

OSVPYSEC-2023-245 7.5

PyPinkSign v0.5.1 uses a non-random or static IV for Cipher Block Chaining (CBC) mode in AES encryption. This vulnerability can lead to the disclosure of information and communications.

Record: PYSEC-2023-245
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSV No score

PyPinkSign v0.5.1 uses a non-random or static IV for Cipher Block Chaining (CBC) mode in AES encryption. This vulnerability can lead to the disclosure of information and communications.

Record: CVE-2023-48056
Updated: 2026-11-02

Affected products

bandoche pypinksign

Affected packages

Affected packages
Package	Affected	Fixed
`pypinksign` PyPI	through 0.5.1	None known
`pypinksign` PyPI	through 0.5.1, plus listed versions 0.10.1.10.20.2.10.2.2 Show 9 moreShow less 0.2.30.30.40.4.10.4.20.4.30.4.40.4.50.5.0	None known
`pypinksign` PyPI	All versions, plus listed versions 0.10.1.10.20.2.10.2.2 Show 13 moreShow less 0.2.30.30.40.4.10.4.20.4.30.4.40.4.50.5.00.5.10.5.20.5.30.5.4	None known

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-48056 is a high vulnerability (CVSS 7.5) in Bandoche Pypinksign, published November 16, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.41%, the 35th percentile. No source names a fixed version.

References

Show 5 moreShow less