PYSEC-2026-1284
Vulnerable OpenSSL included in cryptography wheels
At a glance
- Published
- Updated
- CVE
- CVE-2024-12797
- Aliases
- GHSA-79v4-65xg-pq4g
Description
pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in cryptography 42.0.0-44.0.0 are vulnerable to a security issue. More details about the vulnerability itself can be found in https://openssl-library.org/news/secadv/20250211.txt. If you are building cryptography source ("sdist") then you are responsible for upgrading your copy of OpenSSL. Only users installing from wheels built by the cryptography project (i.e., those distributed on PyPI) need to update their cryptography versions.
Affected packages
| Package | Versions |
|---|---|
| PyPI · cryptography | introduced 42.0.0, fixed 44.0.1 |
References
- https://github.com/pyca/cryptography/security/advisories/GHSA-79v4-65xg-pq4g WEB
- https://nvd.nist.gov/vuln/detail/CVE-2024-12797 ADVISORY
- https://github.com/openssl/openssl/commit/738d4f9fdeaad57660dcba50a619fafced3fd5e9 WEB
- https://github.com/openssl/openssl/commit/798779d43494549b611233f92652f0da5328fbe7 WEB
- https://github.com/openssl/openssl/commit/87ebd203feffcf92ad5889df92f90bb0ee10a699 WEB
- https://github.com/pyca/cryptography PACKAGE
- https://openssl-library.org/news/secadv/20250211.txt WEB
- http://www.openwall.com/lists/oss-security/2025/02/11/3 WEB
- http://www.openwall.com/lists/oss-security/2025/02/11/4 WEB
- https://pypi.org/project/cryptography PACKAGE
- https://github.com/advisories/GHSA-79v4-65xg-pq4g ADVISORY
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — PyPA Advisory Database |