CVE-2023-38325
CVE-2023-38325
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The cryptography package before 41.0.2 for Python mishandles SSH certificates that have critical options.
CVSS 7.5 · High · EPSS 0.7% · Fix available
- Published
- Updated
Stack: python
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
cryptography PyPI
- Versions
- 40.0.0
- 40.0.1
- 40.0.2
- 41.0.0
- 41.0.1
- Affected ranges
- ECOSYSTEM: ≥ 40.0.0, < 41.0.2
Update to 41.0.2
Original sources
- https://github.com/pyca/cryptography/issues/9207
- https://github.com/pyca/cryptography/pull/9208
- https://pypi.org/project/cryptography/#history
- https://github.com/pyca/cryptography/compare/41.0.1...41.0.2
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NMCCTYY3CSNQBFFYYC5DAV6KATHWCUZK/
- https://security.netapp.com/advisory/ntap-20230824-0010/
- https://nvd.nist.gov/vuln/detail/CVE-2023-38325