Skip to content
Log inStart free trial

GHSA-x4qr-2fvf-3mr5 CVE-2023-0286 PYSEC-2026-800 RUSTSEC-2023-0006

Vulnerable OpenSSL included in cryptography wheels

High PyPIcrates.io
Severity
7.4 / 10
High · CVSS 3.1
Exploit chance (EPSS)
69.29%
Chance of exploitation in the next 30 days. Higher than 99.36% of scored vulnerabilities.
Known exploited
No
Not in CISA's catalog
Weakness
CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')
Fix
Available
2 packages have a fixed version

Description

pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in cryptography 0.8.1-39.0.0 are vulnerable to a security issue. More details about the vulnerabilities themselves can be found in https://www.openssl.org/news/secadv/20221213.txt and https://www.openssl.org/news/secadv/20230207.txt.

If you are building cryptography source ("sdist") then you are responsible for upgrading your copy of OpenSSL. Only users installing from wheels built by the cryptography project (i.e., those distributed on PyPI) need to update their cryptography versions.

Affected versions

PyPI

PackageVulnerableFixed in
cryptography
>= 0.8.1, < 39.0.1
39.0.1
cryptography
>= 0.8.1, < 39.0.1
39.0.1

crates.io

PackageVulnerableFixed in
openssl-src
< 111.25.0
111.25.0
openssl-src
>= 300.0.0, < 300.0.12
300.0.12
openssl-src
< 111.25.0
111.25.0
openssl-src
>= 300.0.0, < 300.0.12
300.0.12
openssl-src
>= 0.0.0-0, < 111.25.0
>= 300.0.0, < 300.0.12
111.25.0
300.0.12

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

cryptography PyPI → 39.0.1

pip
pip install --upgrade "cryptography>=39.0.1"
poetry
poetry add "cryptography>=39.0.1"
uv
uv add "cryptography>=39.0.1"

openssl-src crates.io → 111.25.0

cargo
cargo update -p openssl-src --precise 111.25.0

Severity breakdown

CVSS 3.1 7.4

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H

Attack vector
Network
Attack complexity
High
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Weakness

CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')

The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.

References

Advisories

Packages

Other links

Timeline

  1. Published
  2. Last updated by the source
  3. Latest EPSS score
AdvisorySeverityWhy it's related
GHSA-m2h6-j472-rp4c
python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees
Medium Also affects cryptography
GHSA-jwv3-5hgf-82ww
python-cryptography: Duplicate self-signed intermediates can cause exponential path-building
High Also affects cryptography
GHSA-g6cj-pr64-35w5
cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing
High Also affects cryptography
GHSA-537c-gmf6-5ccf
Vulnerable OpenSSL included in cryptography wheels
High Also affects cryptography
GHSA-p423-j2cm-9vmq
Cryptography vulnerable to buffer overflow if non-contiguous buffers were passed to APIs
Medium Also affects cryptography
GHSA-m959-cc7f-wv43
cryptography has incomplete DNS name constraint enforcement on peer names
Low Also affects cryptography
GHSA-r6ph-v2qm-q3c2
cryptography Vulnerable to a Subgroup Attack Due to Missing Subgroup Validation for SECT Curves
High Also affects cryptography
GHSA-79v4-65xg-pq4g
Vulnerable OpenSSL included in cryptography wheels
Medium Also affects cryptography

Credits: ehe9991

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor