affected:
- package:
    ecosystem: PyPI
    name: pypinksign
    purl: pkg:pypi/pypinksign
  ranges:
  - events:
    - introduced: '0'
    type: ECOSYSTEM
  versions:
  - '0.1'
  - 0.1.1
  - '0.2'
  - 0.2.1
  - 0.2.2
  - 0.2.3
  - '0.3'
  - '0.4'
  - 0.4.1
  - 0.4.2
  - 0.4.3
  - 0.4.4
  - 0.4.5
  - 0.5.0
  - 0.5.1
  - 0.5.2
  - 0.5.3
  - 0.5.4
aliases:
- CVE-2023-48056
- GHSA-fxff-wxxv-c2jc
details: PyPinkSign v0.5.1 uses a non-random or static IV for Cipher Block Chaining
  (CBC) mode in AES encryption. This vulnerability can lead to the disclosure of information
  and communications.
id: PYSEC-2023-245
modified: '2026-06-10T16:51:56.494453Z'
published: '2023-11-16T18:15:00Z'
references:
- type: WEB
  url: http://bandoche.com
- type: WEB
  url: http://pypinksign.com
- type: WEB
  url: https://gxx777.github.io/PyPinkSign_v0.5.1_Cryptographic_API_Misuse_Vulnerability.md
- type: ADVISORY
  url: https://github.com/advisories/GHSA-fxff-wxxv-c2jc
severity:
- score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
  type: CVSS_V3