CVE-2026-34073
CVE-2026-34073 · cryptography has incomplete DNS name constraint enforcement on peer names
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to version 46.0.6, DNS name constraints were only validated against SANs within child certificates, and not the "peer name" presented during each validation. Consequently, cryptography would allow a peer named bar.example.com to validate against a wildcard leaf certificate for *.example.com, even if the leaf's parent certificate (or upwards) contained an excluded subtree constraint for bar.example.com. This issue has been patched in version 46.0.6.
CVSS 1.7 · Faible · EPSS 0,2% · Correctif disponible
- Publication
- Mise à jour
Pile logicielle: system · python
Produits et versions concernés
cryptography
- Versions du logiciel
- < 46.0.6: Concernée
Aucun correctif publié
python-cryptography Debian:12
- Versions du logiciel
- 38.0.4-3
- 38.0.4-3+deb12u1
- 38.0.4-4
- 41.0.7-1
- 41.0.7-2
- 41.0.7-3
- 41.0.7-4
- 41.0.7-5
- 42.0.5-1
- 42.0.5-2
- 43.0.0-1
- 43.0.0-2
- 43.0.0-3
- 44.0.2-1
- 44.0.2-2
- 45.0.6-1
- 45.0.6-1~exp1
- 45.0.7-1
- 46.0.1-1
- 46.0.1-1~exp1
- 46.0.5-1
- 46.0.5-2
- 46.0.6-1
- 46.0.7-1
- 47.0.0-1
- 49.0.0-1
- 49.0.0-1~exp1
- 49.0.0-2
- Plages de versions concernées
- ECOSYSTEM: (−∞, +∞)
Aucun correctif publié
python-cryptography Debian:13
- Versions du logiciel
- 43.0.0-3
- 43.0.0-3+deb13u1
- 44.0.2-1
- 44.0.2-2
- 45.0.6-1
- 45.0.6-1~exp1
- 45.0.7-1
- 46.0.1-1
- 46.0.1-1~exp1
- 46.0.5-1
- 46.0.5-2
- 46.0.6-1
- 46.0.7-1
- 47.0.0-1
- 49.0.0-1
- 49.0.0-1~exp1
- 49.0.0-2
- Plages de versions concernées
- ECOSYSTEM: (−∞, +∞)
Aucun correctif publié
python-cryptography Debian:14
- Versions du logiciel
- 43.0.0-3
- 44.0.2-1
- 44.0.2-2
- 45.0.6-1
- 45.0.6-1~exp1
- 45.0.7-1
- 46.0.1-1
- 46.0.1-1~exp1
- 46.0.5-1
- 46.0.5-2
- Plages de versions concernées
- ECOSYSTEM: < 46.0.6-1
Mettez à jour vers 46.0.6-1
cryptography PyPI
- Versions du logiciel
- 0.1
- 0.2
- 0.2.1
- 0.2.2
- 0.3
- 0.4
- 0.5
- 0.5.1
- 0.5.2
- 0.5.3
- 0.5.4
- 0.6
- 0.6.1
- 0.7
- 0.7.1
- 0.7.2
- 0.8
- 0.8.1
- 0.8.2
- 0.9
- 0.9.1
- 0.9.2
- 0.9.3
- 1.0
- 1.0.1
- 1.0.2
- 1.1
- 1.1.1
- 1.1.2
- 1.2
- 1.2.1
- 1.2.2
- 1.2.3
- 1.3
- 1.3.1
- 1.3.2
- 1.3.3
- 1.3.4
- 1.4
- 1.5
- 1.5.1
- 1.5.2
- 1.5.3
- 1.6
- 1.7
- 1.7.1
- 1.7.2
- 1.8
- 1.8.1
- 1.8.2
- 1.9
- 2.0
- 2.0.1
- 2.0.2
- 2.0.3
- 2.1
- 2.1.1
- 2.1.2
- 2.1.3
- 2.1.4
- 2.2
- 2.2.1
- 2.2.2
- 2.3
- 2.3.1
- 2.4
- 2.4.1
- 2.4.2
- 2.5
- 2.6
- 2.6.1
- 2.7
- 2.8
- 2.9
- 2.9.1
- 2.9.2
- 3.0
- 3.1
- 3.1.1
- 3.2
- 3.2.1
- 3.3
- 3.3.1
- 3.3.2
- 3.4
- 3.4.1
- 3.4.2
- 3.4.3
- 3.4.4
- 3.4.5
- 3.4.6
- 3.4.7
- 3.4.8
- 35.0.0
- 36.0.0
- 36.0.1
- 36.0.2
- 37.0.0
- 37.0.1
- 37.0.2
- 37.0.3
- 37.0.4
- 38.0.0
- 38.0.1
- 38.0.2
- 38.0.3
- 38.0.4
- 39.0.0
- 39.0.1
- 39.0.2
- 40.0.0
- 40.0.1
- 40.0.2
- 41.0.0
- 41.0.1
- 41.0.2
- 41.0.3
- 41.0.4
- 41.0.5
- 41.0.6
- 41.0.7
- 42.0.0
- 42.0.1
- 42.0.2
- 42.0.3
- 42.0.4
- 42.0.5
- 42.0.6
- 42.0.7
- 42.0.8
- 43.0.0
- 43.0.1
- 43.0.3
- 44.0.0
- 44.0.1
- 44.0.2
- 44.0.3
- 45.0.0
- 45.0.1
- 45.0.2
- 45.0.3
- 45.0.4
- 45.0.5
- 45.0.6
- 45.0.7
- 46.0.0
- 46.0.1
- 46.0.2
- 46.0.3
- 46.0.4
- 46.0.5
- Plages de versions concernées
- ECOSYSTEM: < 46.0.6
Mettez à jour vers 46.0.6