PT-2022-28180 · Pyca · Cryptography

Published 2022-11-02 · Updated 2022-11-02

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions cryptography versions 37.0.0 through 38.0.3

Description The issue concerns the statically linked copy of OpenSSL in pyca/cryptography's wheels. The included versions of OpenSSL are affected by several security issues, details of which can be found in the official OpenSSL security advisory.

Recommendations For cryptography versions 37.0.0 through 38.0.3, update to a version outside of this range to resolve the issue. If you are building cryptography from source, upgrade your copy of OpenSSL to a secure version.

Related Identifiers

GHSA-39HC-V87J-747X

Affected Products

Cryptography

References · 5

• https://osv.dev/vulnerability/GHSA-39hc-v87j-747x · Vendor Advisory
• https://github.com/pyca/cryptography · Note
• https://github.com/pyca/cryptography/security/advisories/GHSA-39hc-v87j-747x · Note
• https://github.com/pyca/cryptography/commit/382e759bcded5773330eeed748c86b213ec618c5 · Note
• https://github.com/pyca/cryptography/commit/cf2ada625d1188d6cd46396f301b98095da577f7 · Note