p PatchFirst

CVE-2026-26007

CVE-2026-26007 · cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

Esta página muestra una selección de datos de las fuentes. Consulte los avisos enlazados para ver la descripción completa y las versiones afectadas.

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to 46.0.5, the public_key_from_numbers (or EllipticCurvePublicNumbers.public_key()), EllipticCurvePublicNumbers.public_key(), load_der_public_key() and load_pem_public_key() functions do not verify that the point belongs to the expected prime-order subgroup of the curve. This missing validation allows an attacker to provide a public key point P from a small-order subgroup. This can lead to security issues in various situations, such as the most commonly used signature verification (ECDSA) and shared key negotiation (ECDH). When the victim computes the shared secret as S = [victim_private_key]P via ECDH, this leaks information about victim_private_key mod (small_subgroup_order). For curves with cofactor > 1, this reveals the least significant bits of the private key. When these weak public keys are used in ECDSA , it's easy to forge signatures on the small subgroup. Only SECT curves are impacted by this. This vulnerability is fixed in 46.0.5.

CVSS 8.2 · Alta · EPSS 0,4% · Corrección disponible

Publicación
Actualización

Pila tecnológica: system · python

Productos y versiones afectados

  • cryptography

    Versiones
    • < 46.0.5: Afectada

    Sin corrección publicada

  • python-cryptography Debian:12

    Versiones
    • 38.0.4-3
    • 38.0.4-3+deb12u1
    • 38.0.4-4
    • 41.0.7-1
    • 41.0.7-2
    • 41.0.7-3
    • 41.0.7-4
    • 41.0.7-5
    • 42.0.5-1
    • 42.0.5-2
    • 43.0.0-1
    • 43.0.0-2
    • 43.0.0-3
    • 44.0.2-1
    • 44.0.2-2
    • 45.0.6-1
    • 45.0.6-1~exp1
    • 45.0.7-1
    • 46.0.1-1
    • 46.0.1-1~exp1
    • 46.0.5-1
    • 46.0.5-2
    • 46.0.6-1
    • 46.0.7-1
    • 47.0.0-1
    • 49.0.0-1
    • 49.0.0-1~exp1
    • 49.0.0-2
    Intervalos de versiones afectados
    • ECOSYSTEM: (−∞, +∞)

    Sin corrección publicada

  • python-cryptography Debian:13

    Versiones
    • 43.0.0-3
    Intervalos de versiones afectados
    • ECOSYSTEM: < 43.0.0-3+deb13u1

    Actualiza a 43.0.0-3+deb13u1

  • python-cryptography Debian:14

    Versiones
    • 43.0.0-3
    • 44.0.2-1
    • 44.0.2-2
    • 45.0.6-1
    • 45.0.6-1~exp1
    • 45.0.7-1
    • 46.0.1-1
    • 46.0.1-1~exp1
    Intervalos de versiones afectados
    • ECOSYSTEM: < 46.0.5-1

    Actualiza a 46.0.5-1

  • cryptography PyPI

    Versiones
    • 0.1
    • 0.2
    • 0.2.1
    • 0.2.2
    • 0.3
    • 0.4
    • 0.5
    • 0.5.1
    • 0.5.2
    • 0.5.3
    • 0.5.4
    • 0.6
    • 0.6.1
    • 0.7
    • 0.7.1
    • 0.7.2
    • 0.8
    • 0.8.1
    • 0.8.2
    • 0.9
    • 0.9.1
    • 0.9.2
    • 0.9.3
    • 1.0
    • 1.0.1
    • 1.0.2
    • 1.1
    • 1.1.1
    • 1.1.2
    • 1.2
    • 1.2.1
    • 1.2.2
    • 1.2.3
    • 1.3
    • 1.3.1
    • 1.3.2
    • 1.3.3
    • 1.3.4
    • 1.4
    • 1.5
    • 1.5.1
    • 1.5.2
    • 1.5.3
    • 1.6
    • 1.7
    • 1.7.1
    • 1.7.2
    • 1.8
    • 1.8.1
    • 1.8.2
    • 1.9
    • 2.0
    • 2.0.1
    • 2.0.2
    • 2.0.3
    • 2.1
    • 2.1.1
    • 2.1.2
    • 2.1.3
    • 2.1.4
    • 2.2
    • 2.2.1
    • 2.2.2
    • 2.3
    • 2.3.1
    • 2.4
    • 2.4.1
    • 2.4.2
    • 2.5
    • 2.6
    • 2.6.1
    • 2.7
    • 2.8
    • 2.9
    • 2.9.1
    • 2.9.2
    • 3.0
    • 3.1
    • 3.1.1
    • 3.2
    • 3.2.1
    • 3.3
    • 3.3.1
    • 3.3.2
    • 3.4
    • 3.4.1
    • 3.4.2
    • 3.4.3
    • 3.4.4
    • 3.4.5
    • 3.4.6
    • 3.4.7
    • 3.4.8
    • 35.0.0
    • 36.0.0
    • 36.0.1
    • 36.0.2
    • 37.0.0
    • 37.0.1
    • 37.0.2
    • 37.0.3
    • 37.0.4
    • 38.0.0
    • 38.0.1
    • 38.0.2
    • 38.0.3
    • 38.0.4
    • 39.0.0
    • 39.0.1
    • 39.0.2
    • 40.0.0
    • 40.0.1
    • 40.0.2
    • 41.0.0
    • 41.0.1
    • 41.0.2
    • 41.0.3
    • 41.0.4
    • 41.0.5
    • 41.0.6
    • 41.0.7
    • 42.0.0
    • 42.0.1
    • 42.0.2
    • 42.0.3
    • 42.0.4
    • 42.0.5
    • 42.0.6
    • 42.0.7
    • 42.0.8
    • 43.0.0
    • 43.0.1
    • 43.0.3
    • 44.0.0
    • 44.0.1
    • 44.0.2
    • 44.0.3
    • 45.0.0
    • 45.0.1
    • 45.0.2
    • 45.0.3
    • 45.0.4
    • 45.0.5
    • 45.0.6
    • 45.0.7
    • 46.0.0
    • 46.0.1
    • 46.0.2
    • 46.0.3
    • 46.0.4
    Intervalos de versiones afectados
    • ECOSYSTEM: < 46.0.5

    Actualiza a 46.0.5

  • python-cryptography Ubuntu:Pro:16.04:LTS

    Versiones
    • 1.0.1-1ubuntu1
    • 1.0.2-1
    • 1.1-1
    • 1.1.1-1
    • 1.1.1-1ubuntu1
    • 1.1.1-1ubuntu2
    • 1.1.1-1ubuntu3
    • 1.2.2-2
    • 1.2.3-1
    • 1.2.3-1ubuntu0.1
    • 1.2.3-1ubuntu0.2
    • 1.2.3-1ubuntu0.3
    • 1.2.3-1ubuntu0.3+esm1
    Intervalos de versiones afectados
    • ECOSYSTEM: < 1.2.3-1ubuntu0.3+esm3

    Actualiza a 1.2.3-1ubuntu0.3+esm3

  • python-cryptography Ubuntu:Pro:18.04:LTS

    Versiones
    • 1.9-1
    • 2.1.3-3
    • 2.1.4-1
    • 2.1.4-1build1
    • 2.1.4-1build2
    • 2.1.4-1ubuntu1
    • 2.1.4-1ubuntu1.1
    • 2.1.4-1ubuntu1.2
    • 2.1.4-1ubuntu1.3
    • 2.1.4-1ubuntu1.4
    • 2.1.4-1ubuntu1.4+esm1
    Intervalos de versiones afectados
    • ECOSYSTEM: < 2.1.4-1ubuntu1.4+esm3

    Actualiza a 2.1.4-1ubuntu1.4+esm3

  • python-cryptography Ubuntu:Pro:20.04:LTS

    Versiones
    • 2.6.1-3.1
    • 2.6.1-4
    • 2.6.1-4ubuntu1
    • 2.8-1ubuntu2
    • 2.8-2
    • 2.8-3
    • 2.8-3ubuntu0.1
    • 2.8-3ubuntu0.2
    • 2.8-3ubuntu0.3
    Intervalos de versiones afectados
    • ECOSYSTEM: < 2.8-3ubuntu0.3+esm2

    Actualiza a 2.8-3ubuntu0.3+esm2

  • python-cryptography Ubuntu:22.04:LTS

    Versiones
    • 3.3.2-1
    • 3.3.2-1build1
    • 3.4.8-1
    • 3.4.8-1ubuntu1
    • 3.4.8-1ubuntu2
    • 3.4.8-1ubuntu2.1
    • 3.4.8-1ubuntu2.2
    Intervalos de versiones afectados
    • ECOSYSTEM: < 3.4.8-1ubuntu2.3

    Actualiza a 3.4.8-1ubuntu2.3

  • python-cryptography Ubuntu:24.04:LTS

    Versiones
    • 38.0.4-4
    • 38.0.4-4ubuntu1
    • 41.0.7-3
    • 41.0.7-4build2
    • 41.0.7-4build3
    • 41.0.7-4ubuntu0.1
    Intervalos de versiones afectados
    • ECOSYSTEM: < 41.0.7-4ubuntu0.3

    Actualiza a 41.0.7-4ubuntu0.3

  • python-cryptography Ubuntu:25.10

    Versiones
    • 43.0.0-1ubuntu1
    Intervalos de versiones afectados
    • ECOSYSTEM: < 43.0.0-1ubuntu1.1

    Actualiza a 43.0.0-1ubuntu1.1

Fuentes originales

Comprueba tu servidor →