{ "@id": "urn:uuid:46ad60f6-5fbe-4d23-876f-32ae7b50f762", "role": "Document Creator", "author": "https://tuxcare.com", "version": 12, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-10-29T16:39:32.016379+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@41.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@41.0.7.post2+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2023-0286 affects version 41.0.7.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-0286" }, "action_statement": "Vulnerability CVE-2023-0286 affects version 41.0.7.post2+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@41.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@41.0.7.post2+tuxcare" } } ], "timestamp": "2026-10-29T16:14:06.675817+00:00", "status_notes": "Vulnerability CVE-2023-23931 does not affect version 41.0.7.post2+tuxcare of cryptography. not_affected \u2014 The target cryptography 41.0.7.post3+tuxcare is not affected by CVE-2023-23931. The upstream fix (commit 9fbf84efc by Alex Gaynor) that prevents mutation of immutable buffers was already included in the upstream release 41.0.7 before TuxCare's maintenance began. The vulnerable pattern (accepting immutable buffers without writability validation) is not present in HEAD. The code implements two de...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-23931" }, "impact_statement": "not_affected \u2014 The target cryptography 41.0.7.post3+tuxcare is not affected by CVE-2023-23931. The upstream fix (commit 9fbf84efc by Alex Gaynor) that prevents mutation of immutable buffers was already included in the upstream release 41.0.7 before TuxCare's maintenance began. The vulnerable pattern (accepting immutable buffers without writability validation) is not present in HEAD. The code implements two de..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@41.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@41.0.7.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:27:33.941409+00:00", "status_notes": "Vulnerability CVE-2023-38325 affects version 41.0.7.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-38325" }, "action_statement": "Vulnerability CVE-2023-38325 affects version 41.0.7.post2+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@41.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@41.0.7.post2+tuxcare" } } ], "timestamp": "2026-10-29T16:26:05.784106+00:00", "status_notes": "Vulnerability CVE-2023-49083 does not affect version 41.0.7.post2+tuxcare of cryptography. not_affected \u2014 CVE-2023-49083: The target repository (cryptography 41.0.7.post3+tuxcare) is NOT AFFECTED. The vulnerability - a NULL pointer dereference when loading PKCS#7 certificates with no certificates - was fixed in upstream release 41.0.6 (commit f09c261ca1) by Alex Gaynor on 2023-11-27. The fix adds a NULL check on p7.d.sign before dereferencing it to access p7.d.sign.cert, preventing the segfault. Si...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-49083" }, "impact_statement": "not_affected \u2014 CVE-2023-49083: The target repository (cryptography 41.0.7.post3+tuxcare) is NOT AFFECTED. The vulnerability - a NULL pointer dereference when loading PKCS#7 certificates with no certificates - was fixed in upstream release 41.0.6 (commit f09c261ca1) by Alex Gaynor on 2023-11-27. The fix adds a NULL check on p7.d.sign before dereferencing it to access p7.d.sign.cert, preventing the segfault. Si..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@41.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@41.0.7.post2+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2023-50782 is fixed in version 41.0.7.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-50782" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@41.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@41.0.7.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-0727 is fixed in version 41.0.7.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2024-0727" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@41.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@41.0.7.post2+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2024-12797 affects version 41.0.7.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2024-12797" }, "action_statement": "Vulnerability CVE-2024-12797 affects version 41.0.7.post2+tuxcare of cryptography." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@41.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@41.0.7.post2+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2024-26130 is fixed in version 41.0.7.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2024-26130" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@41.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@41.0.7.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-26007 is fixed in version 41.0.7.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-26007" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@41.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@41.0.7.post2+tuxcare" } } ], "timestamp": "2026-10-07T15:46:00.061128+00:00", "status_notes": "Vulnerability CVE-2026-34073 does not affect version 41.0.7.post2+tuxcare of cryptography. not_affected \u2014 The target repository at version 41.0.7.post3+tuxcare is NOT AFFECTED by CVE-2026-34073. The vulnerability exists in the `cryptography-x509-verification` Rust module, which performs X.509 certificate chain verification with DNS name constraint validation. This module does not exist in version 41.0.7 \u2014 it was introduced between versions 41.0.7 and 42.0.0. Version 41.0.7 only provides certificate...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-34073" }, "impact_statement": "not_affected \u2014 The target repository at version 41.0.7.post3+tuxcare is NOT AFFECTED by CVE-2026-34073. The vulnerability exists in the `cryptography-x509-verification` Rust module, which performs X.509 certificate chain verification with DNS name constraint validation. This module does not exist in version 41.0.7 \u2014 it was introduced between versions 41.0.7 and 42.0.0. Version 41.0.7 only provides certificate..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@41.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@41.0.7.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2026-39892 affects version 41.0.7.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-39892" }, "action_statement": "Vulnerability CVE-2026-39892 affects version 41.0.7.post2+tuxcare of cryptography." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@41.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@41.0.7.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2026-69247 affects version 41.0.7.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-69247" }, "action_statement": "Vulnerability CVE-2026-69247 affects version 41.0.7.post2+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@41.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@41.0.7.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69248 does not affect version 41.0.7.post2+tuxcare of cryptography. not_affected \u2014 python-cryptography version 41.0.7.post2+tuxcare is NOT AFFECTED by CVE-2026-69248. The vulnerability exists in the x509 verification module's DNS name constraint matching logic when validating wildcard SANs against intermediate CA constraints. However, the entire x509.verification module (including PolicyBuilder, Store, build_server_verifier, and the Rust cryptography-x509-verification compone...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-69248" }, "impact_statement": "not_affected \u2014 python-cryptography version 41.0.7.post2+tuxcare is NOT AFFECTED by CVE-2026-69248. The vulnerability exists in the x509 verification module's DNS name constraint matching logic when validating wildcard SANs against intermediate CA constraints. However, the entire x509.verification module (including PolicyBuilder, Store, build_server_verifier, and the Rust cryptography-x509-verification compone..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@41.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@41.0.7.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69249 does not affect version 41.0.7.post2+tuxcare of cryptography. not_affected \u2014 Version 41.0.7 is not affected by CVE-2026-69249. The vulnerable x509.verification module with its build_chain_inner function was introduced in cryptography version 42.0.0. Version 41.0.7 predates this feature and has no certificate chain validation API exposed to users. The INPUT type (certificate chains passed to PolicyBuilder.verify()) cannot be received in this version because the entire ve...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-69249" }, "impact_statement": "not_affected \u2014 Version 41.0.7 is not affected by CVE-2026-69249. The vulnerable x509.verification module with its build_chain_inner function was introduced in cryptography version 42.0.0. Version 41.0.7 predates this feature and has no certificate chain validation API exposed to users. The INPUT type (certificate chains passed to PolicyBuilder.verify()) cannot be received in this version because the entire ve..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@41.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@41.0.7.post2+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability GHSA-537c-gmf6-5ccf affects version 41.0.7.post2+tuxcare of cryptography, and is fixed in 41.0.7.post3+tuxcare.", "vulnerability": { "name": "GHSA-537c-gmf6-5ccf" }, "action_statement": "Vulnerability GHSA-537c-gmf6-5ccf affects version 41.0.7.post2+tuxcare of cryptography, and is fixed in 41.0.7.post3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@41.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@41.0.7.post2+tuxcare" } } ], "timestamp": "2026-10-29T16:39:32.016379+00:00", "status_notes": "Vulnerability GHSA-5cpq-8wj7-hf2v does not affect version 41.0.7.post2+tuxcare of cryptography. not_affected \u2014 The target repository (pyca/cryptography 41.0.7 source distribution) is NOT AFFECTED by CVE-2023-2650. The vulnerability exists in OpenSSL's OBJ_obj2txt() function, which is NOT present in this repository. Cryptography uses its own Rust-based ASN.1/OID parser and does not declare or call the vulnerable OpenSSL function in its CFFI bindings. This is a source distribution containing only interfac...", "vulnerability": { "name": "GHSA-5cpq-8wj7-hf2v" }, "impact_statement": "not_affected \u2014 The target repository (pyca/cryptography 41.0.7 source distribution) is NOT AFFECTED by CVE-2023-2650. The vulnerability exists in OpenSSL's OBJ_obj2txt() function, which is NOT present in this repository. Cryptography uses its own Rust-based ASN.1/OID parser and does not declare or call the vulnerable OpenSSL function in its CFFI bindings. This is a source distribution containing only interfac..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@41.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@41.0.7.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-h4gh-qq45-vh27 affects version 41.0.7.post2+tuxcare of cryptography.", "vulnerability": { "name": "GHSA-h4gh-qq45-vh27" }, "action_statement": "Vulnerability GHSA-h4gh-qq45-vh27 affects version 41.0.7.post2+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@41.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@41.0.7.post2+tuxcare" } } ], "timestamp": "2026-10-29T16:10:00.833243+00:00", "status_notes": "Vulnerability GHSA-jm77-qphf-c4w8 does not affect version 41.0.7.post2+tuxcare of cryptography. not_affected \u2014 The target repository (cryptography 41.0.7.post3+tuxcare) is not affected by GHSA-jm77-qphf-c4w8. This CVE concerns vulnerabilities in OpenSSL versions bundled within pre-built wheel binaries of cryptography \u226441.0.2. The target repository does not contain OpenSSL source code (0 C files, no vendored directories). The upstream fix (version 41.0.3, commits bfa4d95f0 and b22271cf3) updated build co...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jm77-qphf-c4w8" }, "impact_statement": "not_affected \u2014 The target repository (cryptography 41.0.7.post3+tuxcare) is not affected by GHSA-jm77-qphf-c4w8. This CVE concerns vulnerabilities in OpenSSL versions bundled within pre-built wheel binaries of cryptography \u226441.0.2. The target repository does not contain OpenSSL source code (0 C files, no vendored directories). The upstream fix (version 41.0.3, commits bfa4d95f0 and b22271cf3) updated build co..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@41.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@41.0.7.post2+tuxcare" } } ], "timestamp": "2026-10-29T16:30:42.638167+00:00", "status_notes": "Vulnerability GHSA-v8gr-m533-ghj9 does not affect version 41.0.7.post2+tuxcare of cryptography. not_affected \u2014 Target version 41.0.7.post3+tuxcare is not affected by GHSA-v8gr-m533-ghj9. The CVE affects cryptography 2.5-41.0.3 due to vulnerable OpenSSL versions bundled in wheels. The upstream fix (version 41.0.4, commit fc11bce69) updated bundled OpenSSL from 3.1.2 to 3.1.3, addressing the vulnerability. This fix was already present in the upstream release when TuxCare onboarded version 41.0.7. The targ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-v8gr-m533-ghj9" }, "impact_statement": "not_affected \u2014 Target version 41.0.7.post3+tuxcare is not affected by GHSA-v8gr-m533-ghj9. The CVE affects cryptography 2.5-41.0.3 due to vulnerable OpenSSL versions bundled in wheels. The upstream fix (version 41.0.4, commit fc11bce69) updated bundled OpenSSL from 3.1.2 to 3.1.3, addressing the vulnerability. This fix was already present in the upstream release when TuxCare onboarded version 41.0.7. The targ..." } ] }