PYSEC-2023-112
At a glance
- Published
- Updated
- CVE
- CVE-2023-38325
- Aliases
- GHSA-cf7p-gm2m-833m
Description
The cryptography package before 41.0.2 for Python mishandles SSH certificates that have critical options.
Affected packages
| Package | Versions |
|---|---|
| PyPI · cryptography | introduced 40.0.0, fixed 41.0.2 |
References
- https://pypi.org/project/cryptography/#history PACKAGE
- https://github.com/pyca/cryptography/compare/41.0.1...41.0.2 WEB
- https://github.com/pyca/cryptography/issues/9207 REPORT
- https://github.com/pyca/cryptography/pull/9208 WEB
- https://github.com/advisories/GHSA-cf7p-gm2m-833m ADVISORY
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — PyPA Advisory Database |