Vulnerabilities for cryptography

First version without a known vulnerability: 50.0.0

Details

• GHSA-m2h6-j472-rp4c2026-08-03

  python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees

  Fixed in: 49.0.0

• GHSA-jwv3-5hgf-82ww2026-08-03

  python-cryptography: Duplicate self-signed intermediates can cause exponential path-building

  Fixed in: 49.0.0

• GHSA-g6cj-pr64-35w52026-08-03

  cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing

  Fixed in: 50.0.0

• GHSA-537c-gmf6-5ccf2026-06-15

  Vulnerable OpenSSL included in cryptography wheels

  Fixed in: 48.0.1

• GHSA-p423-j2cm-9vmq2026-04-08

  Cryptography vulnerable to buffer overflow if non-contiguous buffers were passed to APIs

  Fixed in: 46.0.7

• GHSA-m959-cc7f-wv432026-03-27

  cryptography has incomplete DNS name constraint enforcement on peer names

  Fixed in: 46.0.6

• GHSA-r6ph-v2qm-q3c22026-02-10

  cryptography Vulnerable to a Subgroup Attack Due to Missing Subgroup Validation for SECT Curves

  Fixed in: 46.0.5

• GHSA-79v4-65xg-pq4g2025-02-11

  Vulnerable OpenSSL included in cryptography wheels

  Fixed in: 44.0.1

• GHSA-h4gh-qq45-vh272024-09-03

  pyca/cryptography has a vulnerable OpenSSL included in cryptography wheels

  Fixed in: 43.0.1

• GHSA-6vqw-3v5j-54x42024-02-21

  cryptography NULL pointer dereference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override

  Fixed in: 42.0.4, 97d231672763cdb5959a3b191e692a362f1b9e55

• GHSA-3ww4-gg4f-jr7f2024-02-05

  Python Cryptography package vulnerable to Bleichenbacher timing oracle attack

  Fixed in: 42.0.0

• GHSA-9v9h-cgj8-h64p2024-01-26

  Null pointer dereference in PKCS12 parsing

  Fixed in: 42.0.2

• GHSA-jfhm-5ghh-2f972023-11-28

  cryptography vulnerable to NULL-dereference when loading PKCS7 certificates

  Fixed in: 41.0.6, f09c261ca10a31fe41b1262306db7f8f1da0e48a

• GHSA-v8gr-m533-ghj92023-09-21

  Vulnerable OpenSSL included in cryptography wheels

  Fixed in: 41.0.4

• GHSA-jm77-qphf-c4w82023-08-01

  pyca/cryptography's wheels include vulnerable OpenSSL

  Fixed in: 41.0.3

• GHSA-cf7p-gm2m-833m2023-07-14

  cryptography mishandles SSH certificates

  Fixed in: 41.0.2

• GHSA-5cpq-8wj7-hf2v2023-06-02

  Vulnerable OpenSSL included in cryptography wheels

  Fixed in: 41.0.0

• GHSA-x4qr-2fvf-3mr52023-02-08

  Vulnerable OpenSSL included in cryptography wheels

  Fixed in: 39.0.1, 111.25.0, 300.0.12

• GHSA-w7pp-m8wf-vj6r2023-02-07

  Cipher.update_into can corrupt memory if passed an immutable python object as the outbuf

  Fixed in: 39.0.1, 94a50a9731f35405f0357fa5f3b177d46a726ab3

• GHSA-39hc-v87j-747x2022-11-02

  Vulnerable OpenSSL included in cryptography wheels

  Fixed in: 38.0.3

• GHSA-q3cj-2r34-2cwc2022-05-17

  Improper input validation in cryptography

  Fixed in: 1.5.3, b924696b2e8731f39696584d12cceeb3aeb2d874

• GHSA-rhm9-p9w5-fwm72021-02-10

  PyCA Cryptography symmetrically encrypting large values can lead to integer overflow

  Fixed in: 3.3.2

• GHSA-hggm-jpg3-v4762020-10-27

  RSA decryption vulnerable to Bleichenbacher timing vulnerability

  Fixed in: 3.2, 3.2.1

• GHSA-fcf9-3qw3-gxmj2018-07-31

  PyCA Cryptography vulnerable to GCM tag forgery

  Fixed in: 2.3