{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:49a4d51e-6d71-5d97-8140-702ca53b26d7", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "cryptography", "purl": "pkg:pypi/cryptography@42.0.8.post4+tuxcare", "type": "library", "bom-ref": "pkg:pypi/cryptography@42.0.8.post4+tuxcare", "version": "42.0.8.post4+tuxcare", "pedigree": { "ancestors": [ { "name": "cryptography", "purl": "pkg:pypi/cryptography@42.0.8", "type": "library", "version": "42.0.8" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2023-0286", "affects": [ { "ref": "pkg:pypi/cryptography@42.0.8.post4+tuxcare" } ], "bom-ref": "urn:uuid:e17266af-4cf7-5c69-aeaf-307f201e0ba4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-0286 affects version 42.0.8.post4+tuxcare of cryptography." } }, { "id": "CVE-2023-23931", "affects": [ { "ref": "pkg:pypi/cryptography@42.0.8.post4+tuxcare" } ], "bom-ref": "urn:uuid:ef69c961-a1d8-57f1-bf88-4042f3645e5e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-23931 does not affect version 42.0.8.post4+tuxcare of cryptography. not_affected \u2014 CVE-2023-23931 is NOT present in the target. The vulnerability was fixed in upstream pyca/cryptography version 39.0.1 (released 2023-02-07) by adding `require_writable=True` to the `from_buffer()` call in `Cipher.update_into()`. The target is running version 42.0.8.post4+tuxcare, which already includes this upstream fix. The vulnerable code pattern (accepting immutable buffers that can be mutat...", "justification": "code_not_present" } }, { "id": "CVE-2023-38325", "affects": [ { "ref": "pkg:pypi/cryptography@42.0.8.post4+tuxcare" } ], "bom-ref": "urn:uuid:74b93c24-8d62-599e-a12d-069003167169", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-38325 affects version 42.0.8.post4+tuxcare of cryptography." } }, { "id": "CVE-2023-49083", "affects": [ { "ref": "pkg:pypi/cryptography@42.0.8.post4+tuxcare" } ], "bom-ref": "urn:uuid:0051fd20-1e97-5c98-a921-0444bbcc2e02", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-49083 does not affect version 42.0.8.post4+tuxcare of cryptography. not_affected \u2014 CVE-2023-49083 affects the Python/C-FFI backend implementation of PKCS7 certificate loading, which performed a NULL pointer dereference when processing malformed PKCS7 blobs. Version 42.0.8 is NOT AFFECTED because the vulnerable Python backend code was completely removed in upstream commit 41daf2d8 (January 2024) and replaced with a safe Rust implementation using Option types and pattern matchi...", "justification": "code_not_present" } }, { "id": "CVE-2023-50782", "affects": [ { "ref": "pkg:pypi/cryptography@42.0.8.post4+tuxcare" } ], "bom-ref": "urn:uuid:548cb314-f918-58e2-bd26-a86c8148c092", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-50782 affects version 42.0.8.post4+tuxcare of cryptography." } }, { "id": "CVE-2024-0727", "affects": [ { "ref": "pkg:pypi/cryptography@42.0.8.post4+tuxcare" } ], "bom-ref": "urn:uuid:c5cd3c64-f11f-55de-8fa5-983778556020", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-0727 does not affect version 42.0.8.post4+tuxcare of cryptography. not_affected \u2014 CVE-2024-0727 is an OpenSSL vulnerability (NULL pointer dereference in PKCS12 functions), not a flaw in the cryptography library's own code. The target repository contains only FFI bindings and Python wrappers that call OpenSSL functions\u2014no OpenSSL C source code is present. Verdict: not_affected with justification requires_dependency because the vulnerable code exists solely in the OpenSSL depe...", "justification": "requires_dependency" } }, { "id": "CVE-2024-12797", "affects": [ { "ref": "pkg:pypi/cryptography@42.0.8.post4+tuxcare" } ], "bom-ref": "urn:uuid:2e84022a-45ba-5be3-8d83-aefbc7973ad4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-12797 is fixed in version 42.0.8.post4+tuxcare of cryptography." } }, { "id": "CVE-2024-26130", "affects": [ { "ref": "pkg:pypi/cryptography@42.0.8.post4+tuxcare" } ], "bom-ref": "urn:uuid:84344bef-826a-577c-9a05-4266ee54609f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-26130 affects version 42.0.8.post4+tuxcare of cryptography." } }, { "id": "CVE-2026-26007", "affects": [ { "ref": "pkg:pypi/cryptography@42.0.8.post4+tuxcare" } ], "bom-ref": "urn:uuid:ef18de66-5ec8-5678-9466-1f8fe5fa1dc5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-26007 is fixed in version 42.0.8.post4+tuxcare of cryptography." } }, { "id": "CVE-2026-34073", "affects": [ { "ref": "pkg:pypi/cryptography@42.0.8.post4+tuxcare" } ], "bom-ref": "urn:uuid:136a0cb6-b92a-51d4-bb0c-7d87f723b5ed", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34073 affects version 42.0.8.post4+tuxcare of cryptography." } }, { "id": "CVE-2026-39892", "affects": [ { "ref": "pkg:pypi/cryptography@42.0.8.post4+tuxcare" } ], "bom-ref": "urn:uuid:433c85bc-d39e-5eec-b481-eb59ac7cb06d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-39892 does not affect version 42.0.8.post4+tuxcare of cryptography. not_affected \u2014 Version 42.0.8 is not affected by CVE-2026-39892. The vulnerability exists only in the PyBuffer API implementation (for Python 3.11+) which was introduced in commit 6801b2eb (May 2025), after version 42.0.8 was released. Version 42.0.8 uses the older CFFI-based buffer handling path that does not have this vulnerability. The upstream fix (commit c09d38ae/622d672e) and TuxCare backport (commit 0a...", "justification": "code_not_present" } }, { "id": "CVE-2026-69247", "affects": [ { "ref": "pkg:pypi/cryptography@42.0.8.post4+tuxcare" } ], "bom-ref": "urn:uuid:36f0cc60-b295-5d42-a78f-88a077ddba43", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-69247 affects version 42.0.8.post4+tuxcare of cryptography." } }, { "id": "CVE-2026-69248", "affects": [ { "ref": "pkg:pypi/cryptography@42.0.8.post4+tuxcare" } ], "bom-ref": "urn:uuid:4085f92b-6288-5372-9ba3-fba31a3afaa8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-69248 does not affect version 42.0.8.post4+tuxcare of cryptography. not_affected \u2014 Target version 42.0.8.post2+tuxcare is NOT affected by CVE-2026-69248. The vulnerability requires wildcard DNS SAN support in name constraint validation, which was introduced in upstream commit 286c89128 (Jan 7, 2025) and fixed in commit 91d728897 (Mar 25, 2026, also known as CVE-2026-34073). The 42.x branch never received the vulnerable wildcard support code. Instead, this version uses the old...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-69249", "affects": [ { "ref": "pkg:pypi/cryptography@42.0.8.post4+tuxcare" } ], "bom-ref": "urn:uuid:553a02c9-aeac-5eaf-be79-d4fd1507dbdb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-69249 is fixed in version 42.0.8.post4+tuxcare of cryptography." } }, { "id": "GHSA-537c-gmf6-5ccf", "affects": [ { "ref": "pkg:pypi/cryptography@42.0.8.post4+tuxcare" } ], "bom-ref": "urn:uuid:6a63ae28-c4ae-55ff-a4f2-c37399bd34e9", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-537c-gmf6-5ccf is fixed in version 42.0.8.post4+tuxcare of cryptography." } }, { "id": "GHSA-5cpq-8wj7-hf2v", "affects": [ { "ref": "pkg:pypi/cryptography@42.0.8.post4+tuxcare" } ], "bom-ref": "urn:uuid:ff7eb57d-e357-5ed4-a769-866a3effe461", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-5cpq-8wj7-hf2v does not affect version 42.0.8.post4+tuxcare of cryptography. not_affected \u2014 Target version 42.0.8 is NOT affected by GHSA-5cpq-8wj7-hf2v. This CVE affects cryptography versions 0.5-40.0.2 due to vulnerable OpenSSL versions (1.1.1t, 3.0.8, 3.1.0) bundled in pre-built wheels. The vulnerability was fixed in version 41.0.0+ by updating to patched OpenSSL versions (1.1.1u, 3.0.9, 3.1.1). Target version 42.0.8 bundles even newer OpenSSL versions (1.1.1w, 3.0.13, 3.1.5, 3.2.1...", "justification": "code_not_present" } }, { "id": "GHSA-h4gh-qq45-vh27", "affects": [ { "ref": "pkg:pypi/cryptography@42.0.8.post4+tuxcare" } ], "bom-ref": "urn:uuid:a3284dac-71a9-54da-9726-6149b8b0422a", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-h4gh-qq45-vh27 is fixed in version 42.0.8.post4+tuxcare of cryptography." } }, { "id": "GHSA-jm77-qphf-c4w8", "affects": [ { "ref": "pkg:pypi/cryptography@42.0.8.post4+tuxcare" } ], "bom-ref": "urn:uuid:e550eba8-4833-5cb7-94df-e3b60d01d93c", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-jm77-qphf-c4w8 does not affect version 42.0.8.post4+tuxcare of cryptography. not_affected \u2014 The target repository (cryptography 42.0.8.post4+tuxcare) is not affected by GHSA-jm77-qphf-c4w8. This CVE concerns vulnerable OpenSSL versions bundled in cryptography wheel artifacts, not the cryptography source code itself. The vulnerability affected versions 0.8-41.0.2 which bundled OpenSSL with July 2023 security issues. The fix (version 41.0.3) bundled OpenSSL 3.1.2. The target version (42...", "justification": "requires_dependency" } }, { "id": "GHSA-v8gr-m533-ghj9", "affects": [ { "ref": "pkg:pypi/cryptography@42.0.8.post4+tuxcare" } ], "bom-ref": "urn:uuid:ec7e657e-5e58-5024-b891-003348af7015", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-v8gr-m533-ghj9 does not affect version 42.0.8.post4+tuxcare of cryptography. not_affected \u2014 GHSA-v8gr-m533-ghj9 affects cryptography versions 2.5-41.0.3 due to vulnerable OpenSSL bundled in pre-built binary wheels. The target version (42.0.8.post4+tuxcare) is based on upstream 42.0.0, which updated to OpenSSL 3.2.0\u2014well beyond the vulnerable versions and the 3.1.3 used in the 41.0.4 fix. The vulnerability is in the bundled OpenSSL dependency, not in cryptography's source code. The fix...", "justification": "requires_dependency" } } ], "dependencies": [ { "ref": "pkg:pypi/cryptography@42.0.8.post4+tuxcare" } ] }