GHSA-x4qr-2fvf-3mr5

Source

https://github.com/advisories/GHSA-x4qr-2fvf-3mr5

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/02/GHSA-x4qr-2fvf-3mr5/GHSA-x4qr-2fvf-3mr5.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-x4qr-2fvf-3mr5

Aliases

Related

Published

2023-02-08T22:17:06Z

Modified

2024-02-16T08:08:37.328964Z

Severity

7.4 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H CVSS Calculator

Summary

Vulnerable OpenSSL included in cryptography wheels

Details

pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in cryptography 0.8.1-39.0.0 are vulnerable to a security issue. More details about the vulnerabilities themselves can be found in https://www.openssl.org/news/secadv/20221213.txt and https://www.openssl.org/news/secadv/20230207.txt.

If you are building cryptography source ("sdist") then you are responsible for upgrading your copy of OpenSSL. Only users installing from wheels built by the cryptography project (i.e., those distributed on PyPI) need to update their cryptography versions.

Database specific

{
    "nvd_published_at": "2023-02-08T20:15:00Z",
    "cwe_ids": [
        "CWE-843"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2023-02-08T22:17:06Z"
}

References

Affected packages

PyPI / cryptography

Package

Name: cryptography; View open source insights on deps.dev
Purl: pkg:pypi/cryptography

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0.8.1

Fixed

39.0.1

Affected versions

0.*

0.8.1

0.8.2

0.9

0.9.1

0.9.2

0.9.3

1.*

1.0

1.0.1

1.0.2

1.1

1.1.1

1.1.2

1.2

1.2.1

1.2.2

1.2.3

1.3

1.3.1

1.3.2

1.3.3

1.3.4

1.4

1.5

1.5.1

1.5.2

1.5.3

1.6

1.7

1.7.1

1.7.2

1.8

1.8.1

1.8.2

1.9

2.*

2.0

2.0.1

2.0.2

2.0.3

2.1

2.1.1

2.1.2

2.1.3

2.1.4

2.2

2.2.1

2.2.2

2.3

2.3.1

2.4

2.4.1

2.4.2

2.5

2.6

2.6.1

2.7

2.8

2.9

2.9.1

2.9.2

3.*

3.0

3.1

3.1.1

3.2

3.2.1

3.3

3.3.1

3.3.2

3.4

3.4.1

3.4.2

3.4.3

3.4.4

3.4.5

3.4.6

3.4.7

3.4.8

35.*

35.0.0

36.*

36.0.0

36.0.1

36.0.2

37.*

37.0.0

37.0.1

37.0.2

37.0.3

37.0.4

38.*

38.0.0

38.0.1

38.0.2

38.0.3

38.0.4

39.*

39.0.0

crates.io / openssl-src

Package

Name: openssl-src; View open source insights on deps.dev
Purl: pkg:cargo/openssl-src

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

111.25.0