Homepage
About Snyk

cryptography@42.0.6 vulnerabilities

cryptography is a package which provides cryptographic recipes and primitives to Python developers.

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the cryptography package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • H
Type Confusion

Affected versions of this package are vulnerable to Type Confusion in the do_x509_check() function in x509/v3_utl.c, which is responsible for certificate name checks. An application that specifies an expected DNS name, Email address or IP address that performs a name check on an otherName subject alternative name of an X.509 certificate can be made to crash when it attempts to read an invalid memory address.

Note: Users that are building cryptography source ("sdist") are responsible for upgrading their copy of OpenSSL.

How to fix Type Confusion?

Upgrade cryptography to version 43.0.1 or higher.

[37.0.0,43.0.1)
  • L
Uncontrolled Resource Consumption

Affected versions of this package are vulnerable to Uncontrolled Resource Consumption due to improper user input validation in the EVP_PKEY_param_check or EVP_PKEY_public_check functions. An attacker can cause a denial of service by supplying excessively long DSA keys or parameters obtained from an untrusted source.

Note:

OpenSSL does not call these functions on untrusted DSA keys, so only applications that directly call these functions may be vulnerable.

Also vulnerable are the OpenSSL pkey and pkeyparam command line applications when using the "-check" option.

How to fix Uncontrolled Resource Consumption?

Upgrade cryptography to version 42.0.8 or higher.

[0,42.0.8)
Go back to all versions of this package