Package Instance
Lookup for vulnerable packages by Package URL.
GET /api/packages/40178?format=api
{ "url": "http://public2.vulnerablecode.io/api/packages/40178?format=api", "purl": "pkg:pypi/cryptography@42.0.2", "type": "pypi", "namespace": "", "name": "cryptography", "version": "42.0.2", "qualifiers": {}, "subpath": "", "is_vulnerable": true, "next_non_vulnerable_version": "46.0.7", "latest_non_vulnerable_version": "46.0.7", "affected_by_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/36730?format=api", "vulnerability_id": "VCID-dzvc-j4et-ukgu", "summary": "cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Starting in version 38.0.0 and prior to version 42.0.4, if `pkcs12.serialize_key_and_certificates` is called with both a certificate whose public key did not match the provided private key and an `encryption_algorithm` with `hmac_hash` set (via `PrivateFormat.PKCS12.encryption_builder().hmac_hash(...)`, then a NULL pointer dereference would occur, crashing the Python process. This has been resolved in version 42.0.4, the first version in which a `ValueError` is properly raised.", "references": [ { "reference_url": "https://github.com/pyca/cryptography", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/pyca/cryptography" }, { "reference_url": "https://github.com/pyca/cryptography/commit/97d231672763cdb5959a3b191e692a362f1b9e55", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://github.com/pyca/cryptography/commit/97d231672763cdb5959a3b191e692a362f1b9e55" }, { "reference_url": "https://github.com/pyca/cryptography/pull/10423", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://github.com/pyca/cryptography/pull/10423" }, { "reference_url": "https://github.com/pyca/cryptography/security/advisories/GHSA-6vqw-3v5j-54x4", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://github.com/pyca/cryptography/security/advisories/GHSA-6vqw-3v5j-54x4" }, { "reference_url": "https://github.com/pypa/advisory-database/tree/main/vulns/cryptography/PYSEC-2024-225.yaml", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/pypa/advisory-database/tree/main/vulns/cryptography/PYSEC-2024-225.yaml" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-26130", "reference_id": "CVE-2024-26130", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-26130" }, { "reference_url": "https://github.com/advisories/GHSA-6vqw-3v5j-54x4", "reference_id": "GHSA-6vqw-3v5j-54x4", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-6vqw-3v5j-54x4" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/40180?format=api", "purl": "pkg:pypi/cryptography@42.0.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-jksg-v3x3-z3d3" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/cryptography@42.0.4" } ], "aliases": [ "CVE-2024-26130", "GHSA-6vqw-3v5j-54x4", "PYSEC-2024-225" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-dzvc-j4et-ukgu" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37258?format=api", "vulnerability_id": "VCID-jksg-v3x3-z3d3", "summary": "cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to version 46.0.6, DNS name constraints were only validated against SANs within child certificates, and not the \"peer name\" presented during each validation. Consequently, cryptography would allow a peer named bar.example.com to validate against a wildcard leaf certificate for *.example.com, even if the leaf's parent certificate (or upwards) contained an excluded subtree constraint for bar.example.com. This issue has been patched in version 46.0.6.", "references": [ { "reference_url": "https://github.com/pyca/cryptography/security/advisories/GHSA-m959-cc7f-wv43", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" } ], "url": "https://github.com/pyca/cryptography/security/advisories/GHSA-m959-cc7f-wv43" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/49105?format=api", "purl": "pkg:pypi/cryptography@46.0.6", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-z9ad-ts2t-1bdj" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/cryptography@46.0.6" } ], "aliases": [ "CVE-2026-34073", "GHSA-m959-cc7f-wv43", "PYSEC-2026-35" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-jksg-v3x3-z3d3" } ], "fixing_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/46904?format=api", "vulnerability_id": "VCID-s9by-79q1-27d9", "summary": "Null pointer dereference in PKCS12 parsing\nIssue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL\nto crash leading to a potential Denial of Service attack\n\nImpact summary: Applications loading files in the PKCS12 format from untrusted\nsources might terminate abruptly.\n\nA file in PKCS12 format can contain certificates and keys and may come from an\nuntrusted source. The PKCS12 specification allows certain fields to be NULL, but\nOpenSSL does not correctly check for this case. This can lead to a NULL pointer\ndereference that results in OpenSSL crashing. If an application processes PKCS12\nfiles from an untrusted source using the OpenSSL APIs then that application will\nbe vulnerable to this issue.\n\nOpenSSL APIs that are vulnerable to this are: PKCS12_parse(),\nPKCS12_unpack_p7data(), PKCS12_unpack_p7encdata(), PKCS12_unpack_authsafes()\nand PKCS12_newpass().\n\nWe have also fixed a similar issue in SMIME_write_PKCS7(). However since this\nfunction is related to writing data we do not consider it security significant.\n\nThe FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue.", "references": [ { "reference_url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" }, { "reference_url": "https://cert-portal.siemens.com/productcert/html/ssa-277137.html", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cert-portal.siemens.com/productcert/html/ssa-277137.html" }, { "reference_url": "https://cert-portal.siemens.com/productcert/html/ssa-331112.html", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cert-portal.siemens.com/productcert/html/ssa-331112.html" }, { "reference_url": "https://cert-portal.siemens.com/productcert/html/ssa-769027.html", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cert-portal.siemens.com/productcert/html/ssa-769027.html" }, { "reference_url": "https://cert-portal.siemens.com/productcert/html/ssa-915275.html", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cert-portal.siemens.com/productcert/html/ssa-915275.html" }, { "reference_url": "https://github.com/alexcrichton/openssl-src-rs/commit/add20f73b6b42be7451af2e1044d4e0e778992b2", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/alexcrichton/openssl-src-rs/commit/add20f73b6b42be7451af2e1044d4e0e778992b2" }, { "reference_url": "https://github.com/github/advisory-database/pull/3472", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/github/advisory-database/pull/3472" }, { "reference_url": "https://github.com/openssl/openssl/commit/09df4395b5071217b76dc7d3d2e630eb8c5a79c2", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/openssl/openssl/commit/09df4395b5071217b76dc7d3d2e630eb8c5a79c2" }, { "reference_url": "https://github.com/openssl/openssl/commit/775acfdbd0c6af9ac855f34969cdab0c0c90844a", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/openssl/openssl/commit/775acfdbd0c6af9ac855f34969cdab0c0c90844a" }, { "reference_url": "https://github.com/openssl/openssl/commit/d135eeab8a5dbf72b3da5240bab9ddb7678dbd2c", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/openssl/openssl/commit/d135eeab8a5dbf72b3da5240bab9ddb7678dbd2c" }, { "reference_url": "https://github.com/openssl/openssl/pull/23362", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/openssl/openssl/pull/23362" }, { "reference_url": "https://github.com/pyca/cryptography/commit/3519591d255d4506fbcd0d04037d45271903c64d", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/pyca/cryptography/commit/3519591d255d4506fbcd0d04037d45271903c64d" }, { "reference_url": "https://github.openssl.org/openssl/extended-releases/commit/03b3941d60c4bce58fab69a0c22377ab439bc0e8", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.openssl.org/openssl/extended-releases/commit/03b3941d60c4bce58fab69a0c22377ab439bc0e8" }, { "reference_url": "https://github.openssl.org/openssl/extended-releases/commit/aebaa5883e31122b404e450732dc833dc9dee539", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.openssl.org/openssl/extended-releases/commit/aebaa5883e31122b404e450732dc833dc9dee539" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20240208-0006", "reference_id": "", "reference_type": "", "scores": [], "url": "https://security.netapp.com/advisory/ntap-20240208-0006" }, { "reference_url": "https://www.openssl.org/news/secadv/20240125.txt", "reference_id": "", "reference_type": "", "scores": [], "url": "https://www.openssl.org/news/secadv/20240125.txt" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0727", "reference_id": "CVE-2024-0727", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0727" }, { "reference_url": "https://github.com/advisories/GHSA-9v9h-cgj8-h64p", "reference_id": "GHSA-9v9h-cgj8-h64p", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-9v9h-cgj8-h64p" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/40178?format=api", "purl": "pkg:pypi/cryptography@42.0.2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-dzvc-j4et-ukgu" }, { "vulnerability": "VCID-jksg-v3x3-z3d3" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/cryptography@42.0.2" } ], "aliases": [ "CVE-2024-0727", "GHSA-9v9h-cgj8-h64p" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-s9by-79q1-27d9" } ], "risk_score": null, "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/cryptography@42.0.2" }