CVE-2023-38325
Fixed in a distro release EPSS <1%
The cryptography package before 41.0.2 for Python mishandles SSH certificates that have critical options.
Products: cryptography.io cryptography
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | cryptography | 41.0.2 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.23 | py3-cryptography | 41.0.2-r0 |
| Alpine 3.24 | py3-cryptography | 41.0.2-r0 |
| Chainguard | conda | 23.7.2-r1 |
| Wolfi | conda | 23.7.2-r1 |
| openSUSE Tumbleweed | python-cryptography | 41.0.2-2.1 |
| openSUSE Tumbleweed | python-cryptography | 50.0.0-1.1 |