cryptography

vulnerable: 0.1 ... 1.5.2 (42 versions)

HKDF in cryptography before 1.5.2 returns an empty byte-string if used with a length less than algorithm.digest_size.

vulnerable: 1.9 ... 2.2.2 (13 versions)

A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker cou…

vulnerable: 0.1 ... 3.2 (80 versions)

python-cryptography 3.2 is vulnerable to Bleichenbacher timing attacks in the RSA decryption API, via timed processing of valid PKCS#1 v1.5 ciphertext.

vulnerable: 3.1 ... 3.3.1 (6 versions)

In the cryptography package before 3.3.2 for Python, certain sequences of update calls to symmetrically encrypt multi-GB values could result in an integer overflow and buffer overflow, as demonstrated by the Fernet class.

vulnerable: 0.8.1 ... 39.0.0 (91 versions)

There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of …

vulnerable: 1.8 ... 39.0.0 (61 versions)

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In affected versions `Cipher.update_into` would accept Python objects which implement the buffer protocol, but provide only immutable b…

vulnerable: 40.0.0, 40.0.1, 40.0.2, 41.0.0, 41.0.1

The cryptography package before 41.0.2 for Python mishandles SSH certificates that have critical options.

vulnerable: 3.1 ... 41.0.5 (42 versions)

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling `load_pem_pkcs7_certificates` or `load_der_pkcs7_certificates` could lead to a NULL-pointer dereference and segfault. Exploitat…

vulnerable: 0.1 ... 41.0.7 (121 versions)

A flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data.

vulnerable: 0.1 ... 42.0.1 (123 versions)

Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash leading to a potential Denial of Service attack Impact summary: Applications loading files in the PKCS12 format from untrusted sources might terminate…

vulnerable: 42.0.0 ... 44.0.0 (13 versions)

Issue summary: Clients using RFC7250 Raw Public Keys (RPKs) to authenticate a server may fail to notice that the server was not authenticated, because handshakes don't abort as expected when the SSL_VERIFY_PEER verification mode is set. I…

vulnerable: 38.0.0 ... 42.0.3 (23 versions)

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Starting in version 38.0.0 and prior to version 42.0.4, if `pkcs12.serialize_key_and_certificates` is called with both a certificate wh…

vulnerable: 0.1 ... 46.0.5 (151 versions)

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to version 46.0.6, DNS name constraints were only validated against SANs within child certificates, and not the "peer name" prese…

vulnerable: 45.0.0 ... 46.0.6 (15 versions)

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this co…