{ "@id": "urn:uuid:4ab99d82-96bf-4d18-a3ae-0091535a63bc", "role": "Document Creator", "author": "https://tuxcare.com", "version": 13, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-10-29T16:39:32.016379+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2023-0286 affects version 42.0.0.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-0286" }, "action_statement": "Vulnerability CVE-2023-0286 affects version 42.0.0.post1+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.0.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:14:06.675817+00:00", "status_notes": "Vulnerability CVE-2023-23931 does not affect version 42.0.0.post1+tuxcare of cryptography. not_affected \u2014 The target (cryptography 42.0.0.post3+tuxcare) is NOT AFFECTED by CVE-2023-23931. The vulnerability allowed Cipher.update_into() to accept and mutate immutable buffers by missing the require_writable=True parameter. The fix is already present at line 160 of src/cryptography/hazmat/backends/openssl/ciphers.py. This fix came from upstream commit 9fbf84efc (2023-02-07) authored by Alex Gaynor, whi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-23931" }, "impact_statement": "not_affected \u2014 The target (cryptography 42.0.0.post3+tuxcare) is NOT AFFECTED by CVE-2023-23931. The vulnerability allowed Cipher.update_into() to accept and mutate immutable buffers by missing the require_writable=True parameter. The fix is already present at line 160 of src/cryptography/hazmat/backends/openssl/ciphers.py. This fix came from upstream commit 9fbf84efc (2023-02-07) authored by Alex Gaynor, whi..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:27:33.941409+00:00", "status_notes": "Vulnerability CVE-2023-38325 affects version 42.0.0.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-38325" }, "action_statement": "Vulnerability CVE-2023-38325 affects version 42.0.0.post1+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.0.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:27:17.924054+00:00", "status_notes": "Vulnerability CVE-2023-49083 does not affect version 42.0.0.post1+tuxcare of cryptography. not_affected \u2014 CVE-2023-49083 (NULL-pointer dereference in PKCS7 certificate loading) does not affect target version 42.0.0.post3+tuxcare. The vulnerable Python backend implementation was completely replaced by a Rust implementation (commit 41daf2d86, Jan 2024) that uses memory-safe Option handling instead of raw pointer access. The Rust code at src/rust/src/pkcs7.rs:315-321 uses `pkcs7.signed().and_then(|x| ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-49083" }, "impact_statement": "not_affected \u2014 CVE-2023-49083 (NULL-pointer dereference in PKCS7 certificate loading) does not affect target version 42.0.0.post3+tuxcare. The vulnerable Python backend implementation was completely replaced by a Rust implementation (commit 41daf2d86, Jan 2024) that uses memory-safe Option handling instead of raw pointer access. The Rust code at src/rust/src/pkcs7.rs:315-321 uses `pkcs7.signed().and_then(|x| ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2023-50782 affects version 42.0.0.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-50782" }, "action_statement": "Vulnerability CVE-2023-50782 affects version 42.0.0.post1+tuxcare of cryptography." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-0727 affects version 42.0.0.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2024-0727" }, "action_statement": "Vulnerability CVE-2024-0727 affects version 42.0.0.post1+tuxcare of cryptography." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@42.0.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.0.post1+tuxcare" } } ], "timestamp": "2026-09-28T09:32:48.362925+00:00", "status_notes": "Vulnerability CVE-2024-12797 is fixed in version 42.0.0.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2024-12797" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@42.0.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.0.post1+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2024-26130 is fixed in version 42.0.0.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2024-26130" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-26007 affects version 42.0.0.post1+tuxcare of cryptography, and is fixed in 42.0.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-26007" }, "action_statement": "Vulnerability CVE-2026-26007 affects version 42.0.0.post1+tuxcare of cryptography, and is fixed in 42.0.0.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34073 affects version 42.0.0.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-34073" }, "action_statement": "Vulnerability CVE-2026-34073 affects version 42.0.0.post1+tuxcare of cryptography." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2026-39892 affects version 42.0.0.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-39892" }, "action_statement": "Vulnerability CVE-2026-39892 affects version 42.0.0.post1+tuxcare of cryptography." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2026-69247 affects version 42.0.0.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-69247" }, "action_statement": "Vulnerability CVE-2026-69247 affects version 42.0.0.post1+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.0.post1+tuxcare" } } ], "timestamp": "2026-10-07T15:49:00.173240+00:00", "status_notes": "Vulnerability CVE-2026-69248 does not affect version 42.0.0.post1+tuxcare of cryptography. not_affected \u2014 CVE-2026-69248 affects python-cryptography versions with wildcard DNS SAN support in name constraint validation (introduced in commit 286c89128, Jan 2025). Version 42.0.0.post3 predates that feature and does not include the vulnerable wildcard handling logic. Wildcard SANs are rejected as malformed before reaching validation logic, preventing exploitation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-69248" }, "impact_statement": "not_affected \u2014 CVE-2026-69248 affects python-cryptography versions with wildcard DNS SAN support in name constraint validation (introduced in commit 286c89128, Jan 2025). Version 42.0.0.post3 predates that feature and does not include the vulnerable wildcard handling logic. Wildcard SANs are rejected as malformed before reaching validation logic, preventing exploitation." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69249 affects version 42.0.0.post1+tuxcare of cryptography, and is fixed in 42.0.0.post2+tuxcare.", "vulnerability": { "name": "CVE-2026-69249" }, "action_statement": "Vulnerability CVE-2026-69249 affects version 42.0.0.post1+tuxcare of cryptography, and is fixed in 42.0.0.post2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-537c-gmf6-5ccf does not affect version 42.0.0.post1+tuxcare of cryptography. not_affected \u2014 The target repository (cryptography 42.0.0.post1+tuxcare source code) is not affected by GHSA-537c-gmf6-5ccf. This CVE concerns vulnerable OpenSSL bundled in pre-built PyPI wheels, not the cryptography source code itself. The CVE explicitly excludes source builds from its scope, stating that sdist users are responsible for their own OpenSSL. The target is a source repository with no vendored Op...", "vulnerability": { "name": "GHSA-537c-gmf6-5ccf" }, "impact_statement": "not_affected \u2014 The target repository (cryptography 42.0.0.post1+tuxcare source code) is not affected by GHSA-537c-gmf6-5ccf. This CVE concerns vulnerable OpenSSL bundled in pre-built PyPI wheels, not the cryptography source code itself. The CVE explicitly excludes source builds from its scope, stating that sdist users are responsible for their own OpenSSL. The target is a source repository with no vendored Op..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.0.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:39:32.016379+00:00", "status_notes": "Vulnerability GHSA-5cpq-8wj7-hf2v does not affect version 42.0.0.post1+tuxcare of cryptography. not_affected \u2014 The target version 42.0.0.post3+tuxcare is NOT vulnerable to GHSA-5cpq-8wj7-hf2v (CVE-2023-2650). This CVE affects cryptography wheels that bundle vulnerable OpenSSL versions with a quadratic time complexity issue in OBJ_obj2txt() when processing very large OBJECT IDENTIFIERs. The target bundles OpenSSL 3.2.0 (per CHANGELOG.rst), which is not vulnerable. The fix was shipped in upstream release ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-5cpq-8wj7-hf2v" }, "impact_statement": "not_affected \u2014 The target version 42.0.0.post3+tuxcare is NOT vulnerable to GHSA-5cpq-8wj7-hf2v (CVE-2023-2650). This CVE affects cryptography wheels that bundle vulnerable OpenSSL versions with a quadratic time complexity issue in OBJ_obj2txt() when processing very large OBJECT IDENTIFIERs. The target bundles OpenSSL 3.2.0 (per CHANGELOG.rst), which is not vulnerable. The fix was shipped in upstream release ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.0.post1+tuxcare" } } ], "timestamp": "2026-10-07T15:42:00.095938+00:00", "status_notes": "Vulnerability GHSA-h4gh-qq45-vh27 does not affect version 42.0.0.post1+tuxcare of cryptography. not_affected \u2014 The target repository (pyca/cryptography v42.0.0.post3+tuxcare) is NOT AFFECTED by GHSA-h4gh-qq45-vh27 (CVE-2024-6119). The vulnerability exists in OpenSSL's C implementation of X.509 certificate name checking (specifically, out-of-bounds memory access when processing malformed otherName subject alternative name fields). The cryptography repository contains NO OpenSSL source code - only CFFI bi...", "vulnerability": { "name": "GHSA-h4gh-qq45-vh27" }, "impact_statement": "not_affected \u2014 The target repository (pyca/cryptography v42.0.0.post3+tuxcare) is NOT AFFECTED by GHSA-h4gh-qq45-vh27 (CVE-2024-6119). The vulnerability exists in OpenSSL's C implementation of X.509 certificate name checking (specifically, out-of-bounds memory access when processing malformed otherName subject alternative name fields). The cryptography repository contains NO OpenSSL source code - only CFFI bi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.0.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:08:58.958503+00:00", "status_notes": "Vulnerability GHSA-jm77-qphf-c4w8 does not affect version 42.0.0.post1+tuxcare of cryptography. not_affected \u2014 Target version 42.0.0.post3+tuxcare is not affected by GHSA-jm77-qphf-c4w8. This advisory concerns vulnerable OpenSSL versions bundled in binary wheels for cryptography 0.8-41.0.2. The target is based on upstream version 42.0.0 (released 2024-01-22), which ships wheels compiled with OpenSSL 3.2.0 \u2014 a patched version that does not contain CVE-2023-3446, CVE-2023-3817, or CVE-2023-2975. The fix w...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jm77-qphf-c4w8" }, "impact_statement": "not_affected \u2014 Target version 42.0.0.post3+tuxcare is not affected by GHSA-jm77-qphf-c4w8. This advisory concerns vulnerable OpenSSL versions bundled in binary wheels for cryptography 0.8-41.0.2. The target is based on upstream version 42.0.0 (released 2024-01-22), which ships wheels compiled with OpenSSL 3.2.0 \u2014 a patched version that does not contain CVE-2023-3446, CVE-2023-3817, or CVE-2023-2975. The fix w..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.0.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:29:44.042761+00:00", "status_notes": "Vulnerability GHSA-v8gr-m533-ghj9 does not affect version 42.0.0.post1+tuxcare of cryptography. not_affected \u2014 Target version 42.0.0.post3+tuxcare is above the vulnerable range (2.5-41.0.3). The vulnerability concerns cryptography's binary wheels bundling vulnerable OpenSSL versions. Upstream 42.0.0 (released 2024-01-22) already updated to OpenSSL 3.2.0, which includes fixes for the September 2023 OpenSSL security advisory. This upstream fix was already present in the release that TuxCare based their 42...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-v8gr-m533-ghj9" }, "impact_statement": "not_affected \u2014 Target version 42.0.0.post3+tuxcare is above the vulnerable range (2.5-41.0.3). The vulnerability concerns cryptography's binary wheels bundling vulnerable OpenSSL versions. Upstream 42.0.0 (released 2024-01-22) already updated to OpenSSL 3.2.0, which includes fixes for the September 2023 OpenSSL security advisory. This upstream fix was already present in the release that TuxCare based their 42..." } ] }