cryptography mishandles SSH certificates

🗓️ 14 Jul 2023 21:31:08Reported by GitHub Advisory DatabaseType

github

github🔗 github.com👁 149 Views

cryptography package mishandles SSH certificates with critical option

Reporter	Title	Published	Views	Family All 66
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to weakened security in Python Cryptographic Authority [CVE-2023-38325]	30 Nov 202318:53	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Network Automation 2.6.2 fixes multiple security vulnerabilities	6 Oct 202316:11	–	ibm
IBM Security Bulletins	Security Bulletin: Storage Virtualize ansible collection is affected by a vulnerability in the Python Cryptographic Authority package [CVE-2023-38325]	9 Oct 202313:41	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities exists in IBM Netezza Performance Server Replication Services	27 Feb 202619:55	–	ibm
IBM Security Bulletins	Security Bulletin: z/Transaction Processing Facility is affected by a vulnerability in the Python Cryptographic Authority package [CVE-2023-38325]	29 Aug 202323:49	–	ibm
IBM Security Bulletins	Security Bulletin: QRadar Suite Software includes components with multiple known vulnerabilities	15 Feb 202413:10	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Python Cryptographic Authority cryptography affects IBM Process Mining . CVE-2023-38325	11 Oct 202309:25	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge for IBM Cloud Pak for Data affected by vulnerability in Python Cryptographic Authority cryptography	27 Sep 202321:10	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in CloudPak for Watson AIOps	26 Mar 202503:58	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in cryptography may affect IBM Spectrum Sentinel Anomaly Scan Engine (CVE-2023-23931, CVE-2023-38325)	15 Dec 202313:02	–	ibm

Vulners

Node

cryptography py3.10_cryptographyRange40.0.0–41.0.2pip

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2023-38325
github	www.github.com/pyca/cryptography/issues/9207
github	www.github.com/pyca/cryptography/pull/9208
github	www.github.com/pyca/cryptography/compare/41.0.1...41.0.2
pypi	www.pypi.org/project/cryptography/
github	www.github.com/pyca/cryptography/commit/1ca7adc97b76a9dfbd3d850628b613eb93b78fc3
github	www.github.com/pyca/cryptography/pull/7960
github	www.github.com/pypa/advisory-database/tree/main/vulns/cryptography/PYSEC-2023-112.yaml
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NMCCTYY3CSNQBFFYYC5DAV6KATHWCUZK
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/NMCCTYY3CSNQBFFYYC5DAV6KATHWCUZK

13 Sep 2024 20:06Current

7High risk

Vulners AI Score7

CVSS 3.17.5

EPSS0.01168

SSVC

cryptography mishandles ssh certificates critical options python