Search for packages
| purl | pkg:pypi/cryptography@2.3 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-1vvs-dn11-aaak
Aliases: CVE-2020-25659 GHSA-hggm-jpg3-v476 PYSEC-2021-62 |
python-cryptography 3.2 is vulnerable to Bleichenbacher timing attacks in the RSA decryption API, via timed processing of valid PKCS#1 v1.5 ciphertext. |
Affected by 11 other vulnerabilities. Affected by 10 other vulnerabilities. |
|
VCID-4q68-8rd1-aaah
Aliases: GHSA-5cpq-8wj7-hf2v GMS-2023-1778 |
Vulnerable OpenSSL included in cryptography wheels |
Affected by 8 other vulnerabilities. |
|
VCID-9wtx-9sbn-aaam
Aliases: CVE-2023-0286 GHSA-x4qr-2fvf-3mr5 |
Vulnerable OpenSSL included in cryptography wheels |
Affected by 9 other vulnerabilities. |
|
VCID-ddhe-4ck9-aaam
Aliases: CVE-2023-50782 GHSA-3ww4-gg4f-jr7f |
python-cryptography: Bleichenbacher timing oracle attack against RSA decryption - incomplete fix for CVE-2020-25659 |
Affected by 4 other vulnerabilities. |
|
VCID-df7k-xenc-aaar
Aliases: CVE-2023-38325 GHSA-cf7p-gm2m-833m PYSEC-2023-112 |
The cryptography package before 41.0.2 for Python mishandles SSH certificates that have critical options. |
Affected by 7 other vulnerabilities. |
|
VCID-j6cb-jtt4-aaas
Aliases: CVE-2020-36242 GHSA-rhm9-p9w5-fwm7 PYSEC-2021-63 |
In the cryptography package before 3.3.2 for Python, certain sequences of update calls to symmetrically encrypt multi-GB values could result in an integer overflow and buffer overflow, as demonstrated by the Fernet class. |
Affected by 9 other vulnerabilities. |
|
VCID-jm31-c3d3-aaap
Aliases: CVE-2024-0727 GHSA-9v9h-cgj8-h64p |
openssl: denial of service via null dereference |
Affected by 3 other vulnerabilities. |
|
VCID-vqz2-zd9g-aaab
Aliases: CVE-2023-23931 GHSA-w7pp-m8wf-vj6r PYSEC-0000-CVE-2023-23931 PYSEC-2023-11 |
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In affected versions `Cipher.update_into` would accept Python objects which implement the buffer protocol, but provide only immutable buffers. This would allow immutable objects (such as `bytes`) to be mutated, thus violating fundamental rules of Python and resulting in corrupted output. This now correctly raises an exception. This issue has been present since `update_into` was originally introduced in cryptography 1.8. |
Affected by 9 other vulnerabilities. |
|
VCID-w668-5d2j-aaar
Aliases: GHSA-jm77-qphf-c4w8 GMS-2023-1898 |
pyca/cryptography's wheels include vulnerable OpenSSL |
Affected by 6 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-69da-bw9p-aaae | A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage. |
CVE-2018-10903
GHSA-fcf9-3qw3-gxmj PYSEC-2018-52 |