{ "@id": "urn:uuid:48ae3d70-a1cc-496e-a287-dc04e430cb7c", "role": "Document Creator", "author": "https://tuxcare.com", "version": 14, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-10-29T16:45:45.459074+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2023-0286 affects version 43.0.1.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-0286" }, "action_statement": "Vulnerability CVE-2023-0286 affects version 43.0.1.post1+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:14:06.675817+00:00", "status_notes": "Vulnerability CVE-2023-23931 does not affect version 43.0.1.post1+tuxcare of cryptography. not_affected \u2014 CVE-2023-23931 is NOT present in cryptography 43.0.1.post4+tuxcare. The vulnerability was fixed in upstream version 39.0.1 (Feb 2023), well before version 43.0.1 was released. The target version includes the fix through its upstream lineage. Although the implementation migrated from Python/cffi to Rust between versions 39.x and 43.x, the defense is semantically equivalent: the Rust code enforce...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-23931" }, "impact_statement": "not_affected \u2014 CVE-2023-23931 is NOT present in cryptography 43.0.1.post4+tuxcare. The vulnerability was fixed in upstream version 39.0.1 (Feb 2023), well before version 43.0.1 was released. The target version includes the fix through its upstream lineage. Although the implementation migrated from Python/cffi to Rust between versions 39.x and 43.x, the defense is semantically equivalent: the Rust code enforce..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:27:33.941409+00:00", "status_notes": "Vulnerability CVE-2023-38325 affects version 43.0.1.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-38325" }, "action_statement": "Vulnerability CVE-2023-38325 affects version 43.0.1.post1+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:24:37.696326+00:00", "status_notes": "Vulnerability CVE-2023-49083 does not affect version 43.0.1.post1+tuxcare of cryptography. not_affected \u2014 CVE-2023-49083 is NOT present in cryptography 43.0.1. The NULL-pointer dereference vulnerability was fixed by upstream in commit 1e7b4d074 (Nov 27, 2023), which added a NULL check before accessing p7.d.sign.cert. The code was later migrated to Rust (commit 41daf2d86, Jan 22, 2024), where the fix is maintained via safe pattern matching (pkcs7.signed().and_then()). Both fixes are present in HEAD ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-49083" }, "impact_statement": "not_affected \u2014 CVE-2023-49083 is NOT present in cryptography 43.0.1. The NULL-pointer dereference vulnerability was fixed by upstream in commit 1e7b4d074 (Nov 27, 2023), which added a NULL check before accessing p7.d.sign.cert. The code was later migrated to Rust (commit 41daf2d86, Jan 22, 2024), where the fix is maintained via safe pattern matching (pkcs7.signed().and_then()). Both fixes are present in HEAD ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2023-50782 affects version 43.0.1.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-50782" }, "action_statement": "Vulnerability CVE-2023-50782 affects version 43.0.1.post1+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:19:27.667174+00:00", "status_notes": "Vulnerability CVE-2024-0727 does not affect version 43.0.1.post1+tuxcare of cryptography. not_affected \u2014 CVE-2024-0727 is an OpenSSL vulnerability affecting PKCS12 parsing functions (PKCS12_parse, PKCS12_unpack_p7data, etc.) that can lead to NULL pointer dereference and DoS. The cryptography library calls these OpenSSL APIs via Rust FFI (pkcs12.rs lines 702-724), but bundles OpenSSL 3.4.6 in its wheels, which has the vulnerability fixed. The upstream 43.0.1 release (September 2024) already shipped...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-0727" }, "impact_statement": "not_affected \u2014 CVE-2024-0727 is an OpenSSL vulnerability affecting PKCS12 parsing functions (PKCS12_parse, PKCS12_unpack_p7data, etc.) that can lead to NULL pointer dereference and DoS. The cryptography library calls these OpenSSL APIs via Rust FFI (pkcs12.rs lines 702-724), but bundles OpenSSL 3.4.6 in its wheels, which has the vulnerability fixed. The upstream 43.0.1 release (September 2024) already shipped..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post1+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2024-12797 is fixed in version 43.0.1.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2024-12797" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:00:55.169132+00:00", "status_notes": "Vulnerability CVE-2024-26130 affects version 43.0.1.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2024-26130" }, "action_statement": "Vulnerability CVE-2024-26130 affects version 43.0.1.post1+tuxcare of cryptography." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-26007 affects version 43.0.1.post1+tuxcare of cryptography, and is fixed in 43.0.1.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-26007" }, "action_statement": "Vulnerability CVE-2026-26007 affects version 43.0.1.post1+tuxcare of cryptography, and is fixed in 43.0.1.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34073 affects version 43.0.1.post1+tuxcare of cryptography, and is fixed in 43.0.1.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-34073" }, "action_statement": "Vulnerability CVE-2026-34073 affects version 43.0.1.post1+tuxcare of cryptography, and is fixed in 43.0.1.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2026-39892 affects version 43.0.1.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-39892" }, "action_statement": "Vulnerability CVE-2026-39892 affects version 43.0.1.post1+tuxcare of cryptography." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2026-69247 affects version 43.0.1.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-69247" }, "action_statement": "Vulnerability CVE-2026-69247 affects version 43.0.1.post1+tuxcare of cryptography." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69248 affects version 43.0.1.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-69248" }, "action_statement": "Vulnerability CVE-2026-69248 affects version 43.0.1.post1+tuxcare of cryptography." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69249 affects version 43.0.1.post1+tuxcare of cryptography, and is fixed in 43.0.1.post2+tuxcare.", "vulnerability": { "name": "CVE-2026-69249" }, "action_statement": "Vulnerability CVE-2026-69249 affects version 43.0.1.post1+tuxcare of cryptography, and is fixed in 43.0.1.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability GHSA-537c-gmf6-5ccf affects version 43.0.1.post1+tuxcare of cryptography, and is fixed in 43.0.1.post4+tuxcare.", "vulnerability": { "name": "GHSA-537c-gmf6-5ccf" }, "action_statement": "Vulnerability GHSA-537c-gmf6-5ccf affects version 43.0.1.post1+tuxcare of cryptography, and is fixed in 43.0.1.post4+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:45:45.459074+00:00", "status_notes": "Vulnerability GHSA-5cpq-8wj7-hf2v does not affect version 43.0.1.post1+tuxcare of cryptography. not_affected \u2014 CVE-2023-2650 is an OpenSSL vulnerability in OBJ_obj2txt() that affects OpenSSL versions prior to 3.0.9/3.1.1/1.1.1u. The cryptography source repository does not vendor OpenSSL code - it only declares OpenSSL as a dependency via Rust crates (openssl 0.10.66, openssl-sys 0.9.101). The vulnerable code is not present in this repository. While upstream cryptography 43.0.1 bundles OpenSSL 3.3.2 in i...", "vulnerability": { "name": "GHSA-5cpq-8wj7-hf2v" }, "impact_statement": "not_affected \u2014 CVE-2023-2650 is an OpenSSL vulnerability in OBJ_obj2txt() that affects OpenSSL versions prior to 3.0.9/3.1.1/1.1.1u. The cryptography source repository does not vendor OpenSSL code - it only declares OpenSSL as a dependency via Rust crates (openssl 0.10.66, openssl-sys 0.9.101). The vulnerable code is not present in this repository. While upstream cryptography 43.0.1 bundles OpenSSL 3.3.2 in i..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:02:50.581840+00:00", "status_notes": "Vulnerability GHSA-h4gh-qq45-vh27 does not affect version 43.0.1.post1+tuxcare of cryptography. not_affected \u2014 The target source repository (cryptography 43.0.1.post4+tuxcare) is not affected by CVE-2024-6119 (GHSA-h4gh-qq45-vh27). This CVE affects OpenSSL versions 3.0-3.3 prior to their respective patch releases (3.3.2, 3.2.3, 3.1.7, 3.0.15). The vulnerability is in OpenSSL's X.509 certificate name checking code, which causes denial of service via invalid memory reads. The cryptography source repositor...", "vulnerability": { "name": "GHSA-h4gh-qq45-vh27" }, "impact_statement": "not_affected \u2014 The target source repository (cryptography 43.0.1.post4+tuxcare) is not affected by CVE-2024-6119 (GHSA-h4gh-qq45-vh27). This CVE affects OpenSSL versions 3.0-3.3 prior to their respective patch releases (3.3.2, 3.2.3, 3.1.7, 3.0.15). The vulnerability is in OpenSSL's X.509 certificate name checking code, which causes denial of service via invalid memory reads. The cryptography source repositor..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:08:58.958503+00:00", "status_notes": "Vulnerability GHSA-jm77-qphf-c4w8 does not affect version 43.0.1.post1+tuxcare of cryptography. not_affected \u2014 The target cryptography version 43.0.1.post4+tuxcare is not affected by GHSA-jm77-qphf-c4w8. This CVE concerns vulnerable OpenSSL versions bundled in cryptography wheels versions 0.8-41.0.2. The fix was released in version 41.0.3 (2023-08-01) which updated wheels to use OpenSSL 3.1.2. The target version 43.0.1 (released 2024-09-03) is significantly newer and ships with OpenSSL 3.3.2 in its whee...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jm77-qphf-c4w8" }, "impact_statement": "not_affected \u2014 The target cryptography version 43.0.1.post4+tuxcare is not affected by GHSA-jm77-qphf-c4w8. This CVE concerns vulnerable OpenSSL versions bundled in cryptography wheels versions 0.8-41.0.2. The fix was released in version 41.0.3 (2023-08-01) which updated wheels to use OpenSSL 3.1.2. The target version 43.0.1 (released 2024-09-03) is significantly newer and ships with OpenSSL 3.3.2 in its whee..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:33:51.306192+00:00", "status_notes": "Vulnerability GHSA-v8gr-m533-ghj9 does not affect version 43.0.1.post1+tuxcare of cryptography. not_affected \u2014 The target version (cryptography 43.0.1.post4+tuxcare) is NOT affected by CVE-2023-4807. The vulnerability affects OpenSSL versions 3.1.0-3.1.2 (and other ranges) and was fixed in OpenSSL 3.1.3. The upstream cryptography 43.0.1 release (Sept 2024) shipped with OpenSSL 3.3.2, and the current target bundles OpenSSL 3.4.6 \u2014 both well beyond the fixed version. The vulnerable code pattern was never ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-v8gr-m533-ghj9" }, "impact_statement": "not_affected \u2014 The target version (cryptography 43.0.1.post4+tuxcare) is NOT affected by CVE-2023-4807. The vulnerability affects OpenSSL versions 3.1.0-3.1.2 (and other ranges) and was fixed in OpenSSL 3.1.3. The upstream cryptography 43.0.1 release (Sept 2024) shipped with OpenSSL 3.3.2, and the current target bundles OpenSSL 3.4.6 \u2014 both well beyond the fixed version. The vulnerable code pattern was never ..." } ] }