cryptography@41.0.4 vulnerabilities
cryptography is a package which provides cryptographic recipes and primitives to Python developers.
-
latest version
42.0.6
-
latest non vulnerable version
-
first published
10 years ago
-
latest version published
a day ago
-
licenses detected
- [41.0.0,)
Direct Vulnerabilities
Known vulnerabilities in the cryptography package. This does not include vulnerabilities belonging to this package’s dependencies.
Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.Vulnerability | Vulnerable Version |
---|---|
Affected versions of this package are vulnerable to Uncontrolled Resource Consumption ('Resource Exhaustion') due to the session cache entering an incorrect state and failing to flush properly as it fills, leading to uncontrolled memory consumption. This condition is triggered under certain server configurations when processing TLSv1.3 sessions. Specifically, this occurs if the non-default Note: This issue is only exploitable if the server supports TLSv1.3 and is configured with the How to fix Uncontrolled Resource Consumption ('Resource Exhaustion')? Upgrade |
[35.0.0,42.0.6)
|
Affected versions of this package are vulnerable to NULL Pointer Dereference in the Note: This is only exploitable if the vulnerable function is called with both:
How to fix NULL Pointer Dereference? Upgrade |
[38.0.0,42.0.4)
|
Affected versions of this package are vulnerable to NULL Pointer Dereference when processing a maliciously formatted PKCS12 file. The vulnerability exists due to improper handling of optional How to fix NULL Pointer Dereference? Upgrade |
[,42.0.2)
|
Affected versions of this package are vulnerable to Resource Exhaustion via the How to fix Resource Exhaustion? Upgrade |
[35.0.0,42.0.2)
|
Affected versions of this package are vulnerable to Use of a Broken or Risky Cryptographic Algorithm due to an issue in the Note: This is only exploitable if the attacker has the ability to affect the algorithm's usage and the application relies on non-volatile XMM registers. How to fix Use of a Broken or Risky Cryptographic Algorithm? Upgrade |
[35.0.0,42.0.2)
|
Affected versions of this package are vulnerable to Observable Timing Discrepancy. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data (Marvin). Note: This vulnerability exists due to an incomplete fix for CVE-2020-25659. How to fix Observable Timing Discrepancy? Upgrade |
[,42.0.0)
|
Affected versions of this package are vulnerable to NULL Pointer Dereference when loading PKCS7 certificates. An attacker can cause a Denial of Service (DoS) by attempting to deserialize a PKCS7 blob/certificate. Note: This is only exploitable if the How to fix NULL Pointer Dereference? Upgrade |
[3.1,41.0.6)
|
Affected versions of this package are vulnerable to Denial of Service (DoS) when the Note: This is only exploitable if the application uses these functions to generate or check an X9.42 DH key or parameters. Also, the OpenSSL How to fix Denial of Service (DoS)? Upgrade |
[,42.0.0)
|
Affected versions of this package are vulnerable to Missing Cryptographic Step when the Both truncations and overruns of the key and the IV will produce incorrect results and could, in some cases, trigger a memory exception. How to fix Missing Cryptographic Step? Upgrade |
[,41.0.5)
|