GHSA-5cpq-8wj7-hf2v
Vulnerable OpenSSL included in cryptography wheels
- Severity
- Low
- The publisher's own rating, not a CVSS score
- Exploit chance (EPSS)
- —
- No score published
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- —
- Not classified
- Fix
41.0.0- Upgrade cryptography to this version or later
Description
pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in cryptography 0.5-40.0.2 are vulnerable to a security issue. More details about the vulnerability itself can be found in https://www.openssl.org/news/secadv/20230530.txt.
If you are building cryptography source ("sdist") then you are responsible for upgrading your copy of OpenSSL. Only users installing from wheels built by the cryptography project (i.e., those distributed on PyPI) need to update their cryptography versions.
Affected versions
PyPI
| Package | Vulnerable | Fixed in |
|---|---|---|
| cryptography | >= 0.5, < 41.0.0 |
41.0.0 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
cryptography PyPI → 41.0.0
- pip
pip install --upgrade "cryptography>=41.0.0"- poetry
poetry add "cryptography>=41.0.0"- uv
uv add "cryptography>=41.0.0"
References
Packages
Other links
Timeline
- Published
- Last updated by the source
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-m2h6-j472-rp4c python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees | Medium | Also affects cryptography |
| GHSA-jwv3-5hgf-82ww python-cryptography: Duplicate self-signed intermediates can cause exponential path-building | High | Also affects cryptography |
| GHSA-g6cj-pr64-35w5 cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing | High | Also affects cryptography |
| GHSA-537c-gmf6-5ccf Vulnerable OpenSSL included in cryptography wheels | High | Also affects cryptography |
| GHSA-p423-j2cm-9vmq Cryptography vulnerable to buffer overflow if non-contiguous buffers were passed to APIs | Medium | Also affects cryptography |
| GHSA-m959-cc7f-wv43 cryptography has incomplete DNS name constraint enforcement on peer names | Low | Also affects cryptography |
| GHSA-r6ph-v2qm-q3c2 cryptography Vulnerable to a Subgroup Attack Due to Missing Subgroup Validation for SECT Curves | High | Also affects cryptography |
| GHSA-79v4-65xg-pq4g Vulnerable OpenSSL included in cryptography wheels | Medium | Also affects cryptography |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor