CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NCVE-2023-38325
High (7.5) in cryptography.io cryptography. EPSS 0.7% chance of exploitation in the next 30 days. Fixed in cryptography 41.0.2.
The cryptography package before 41.0.2 for Python mishandles SSH certificates that have critical options.
Severity
- EPSS
- 0.7% chance of exploitation in the next 30 days; higher than 54% of CVEs (scores of 2026-10-31)
- CWE
- CWE-295
- Published
- Modified
- Record from
- the NVD, synced
Affected
- cryptography.io:cryptography
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-cf7p-gm2m-833m | PyPI | cryptography | >=40.0.0 <41.0.2 | 41.0.2 |
| PYSEC-2023-112 | PyPI | cryptography | >=40.0.0 <41.0.2 | 41.0.2 |
References
- https://github.com/pyca/cryptography/compare/41.0.1...41.0.2
- https://github.com/pyca/cryptography/issues/9207
- https://github.com/pyca/cryptography/pull/9208
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NMCCTYY3CSNQBFFYYC5DAV6KATHWCUZK/
- https://pypi.org/project/cryptography/#history