USN-8087-2

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/notices/USN-8087-2
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8087-2.json
JSON Data
https://api.osv.dev/v1/vulns/USN-8087-2
Published
2026-03-16T11:35:04Z
Modified
2026-03-17T06:42:53.117036Z
Summary
python-cryptography regression
Details

USN-8087-1 fixed a vulnerability in python-cryptography. The update caused a regression when using ECC algorithms with certain software. This update fixes the problem.

We apologize for the inconvenience.

Original advisory details:

It was discovered that python-cryptography incorrectly handled subgroup validation for SECT curves. A remote attacker could use this issue to perform a subgroup attack and possibly recover the least significant bits of private keys.

References

Affected packages

Ubuntu:22.04:LTS / python-cryptography

Package

Name
python-cryptography
Purl
pkg:deb/ubuntu/python-cryptography@3.4.8-1ubuntu2.4?arch=source&distro=jammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.4.8-1ubuntu2.4

Affected versions

3.*
3.3.2-1
3.3.2-1build1
3.4.8-1
3.4.8-1ubuntu1
3.4.8-1ubuntu2
3.4.8-1ubuntu2.1
3.4.8-1ubuntu2.2
3.4.8-1ubuntu2.3

Ecosystem specific 

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_version": "3.4.8-1ubuntu2.4",
            "binary_name": "python3-cryptography"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8087-2.json"
cves_map 
{
    "cves": [],
    "ecosystem": "Ubuntu:22.04:LTS"
}

Ubuntu:24.04:LTS / python-cryptography

Package

Name
python-cryptography
Purl
pkg:deb/ubuntu/python-cryptography@41.0.7-4ubuntu0.4?arch=source&distro=noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
41.0.7-4ubuntu0.4

Affected versions

38.*
38.0.4-4
38.0.4-4ubuntu1
41.*
41.0.7-3
41.0.7-4build2
41.0.7-4build3
41.0.7-4ubuntu0.1
41.0.7-4ubuntu0.3

Ecosystem specific 

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_version": "41.0.7-4ubuntu0.4",
            "binary_name": "python3-cryptography"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8087-2.json"
cves_map 
{
    "cves": [],
    "ecosystem": "Ubuntu:24.04:LTS"
}

Ubuntu:25.10 / python-cryptography

Package

Name
python-cryptography
Purl
pkg:deb/ubuntu/python-cryptography@43.0.0-1ubuntu1.2?arch=source&distro=questing

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
43.0.0-1ubuntu1.2

Affected versions

43.*
43.0.0-1ubuntu1
43.0.0-1ubuntu1.1

Ecosystem specific 

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_version": "43.0.0-1ubuntu1.2",
            "binary_name": "python3-cryptography"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8087-2.json"
cves_map 
{
    "cves": [],
    "ecosystem": "Ubuntu:25.10"
}