{ "@id": "urn:uuid:50699e3e-f56b-4f15-9a09-9ce50ac5a7ea", "role": "Document Creator", "author": "https://tuxcare.com", "version": 13, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-10-29T16:38:31.252565+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post5+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2023-0286 affects version 43.0.3.post5+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-0286" }, "action_statement": "Vulnerability CVE-2023-0286 affects version 43.0.3.post5+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post5+tuxcare" } } ], "timestamp": "2026-10-29T16:10:35.103463+00:00", "status_notes": "Vulnerability CVE-2023-23931 does not affect version 43.0.3.post5+tuxcare of cryptography. not_affected \u2014 CVE-2023-23931 is not present in cryptography 43.0.3. The vulnerability was fixed in upstream version 39.0.1 (February 2023) by adding buffer writability validation. The target version 43.0.3 uses a Rust-based implementation that includes the fix: the `CffiMutBuf` type enforces `require_writable=True` when extracting mutable buffers, preventing immutable objects from being mutated. The fix comm...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-23931" }, "impact_statement": "not_affected \u2014 CVE-2023-23931 is not present in cryptography 43.0.3. The vulnerability was fixed in upstream version 39.0.1 (February 2023) by adding buffer writability validation. The target version 43.0.3 uses a Rust-based implementation that includes the fix: the `CffiMutBuf` type enforces `require_writable=True` when extracting mutable buffers, preventing immutable objects from being mutated. The fix comm..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:27:33.941409+00:00", "status_notes": "Vulnerability CVE-2023-38325 affects version 43.0.3.post5+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-38325" }, "action_statement": "Vulnerability CVE-2023-38325 affects version 43.0.3.post5+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post5+tuxcare" } } ], "timestamp": "2026-10-29T16:24:37.696326+00:00", "status_notes": "Vulnerability CVE-2023-49083 does not affect version 43.0.3.post5+tuxcare of cryptography. not_affected \u2014 Target version 43.0.3 uses a Rust implementation of PKCS7 certificate loading that inherently prevents NULL-pointer dereferences through memory-safe Option types and pattern matching. The vulnerability exists only in the Python OpenSSL backend (versions < 41.0.6), which was replaced by Rust in later versions. Test evidence confirms the PoC raises ValueError instead of crashing.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2023-49083" }, "impact_statement": "not_affected \u2014 Target version 43.0.3 uses a Rust implementation of PKCS7 certificate loading that inherently prevents NULL-pointer dereferences through memory-safe Option types and pattern matching. The vulnerability exists only in the Python OpenSSL backend (versions < 41.0.6), which was replaced by Rust in later versions. Test evidence confirms the PoC raises ValueError instead of crashing." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post5+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2023-50782 affects version 43.0.3.post5+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-50782" }, "action_statement": "Vulnerability CVE-2023-50782 affects version 43.0.3.post5+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post5+tuxcare" } } ], "timestamp": "2026-10-29T16:17:04.150532+00:00", "status_notes": "Vulnerability CVE-2024-0727 does not affect version 43.0.3.post5+tuxcare of cryptography. not_affected \u2014 CVE-2024-0727 is an OpenSSL vulnerability (NULL pointer dereference in PKCS12 functions). The target repository (pyca/cryptography 43.0.3.post5+tuxcare) does NOT contain OpenSSL's vulnerable C source code - it only contains Python and Rust wrapper code that calls OpenSSL via the `openssl` Rust crate (declared dependency). The vulnerability exists exclusively in OpenSSL's C implementation, not i...", "vulnerability": { "name": "CVE-2024-0727" }, "impact_statement": "not_affected \u2014 CVE-2024-0727 is an OpenSSL vulnerability (NULL pointer dereference in PKCS12 functions). The target repository (pyca/cryptography 43.0.3.post5+tuxcare) does NOT contain OpenSSL's vulnerable C source code - it only contains Python and Rust wrapper code that calls OpenSSL via the `openssl` Rust crate (declared dependency). The vulnerability exists exclusively in OpenSSL's C implementation, not i..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post5+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2024-12797 is fixed in version 43.0.3.post5+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2024-12797" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:00:55.169132+00:00", "status_notes": "Vulnerability CVE-2024-26130 affects version 43.0.3.post5+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2024-26130" }, "action_statement": "Vulnerability CVE-2024-26130 affects version 43.0.3.post5+tuxcare of cryptography." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-26007 is fixed in version 43.0.3.post5+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-26007" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34073 is fixed in version 43.0.3.post5+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-34073" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2026-39892 affects version 43.0.3.post5+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-39892" }, "action_statement": "Vulnerability CVE-2026-39892 affects version 43.0.3.post5+tuxcare of cryptography." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2026-69247 affects version 43.0.3.post5+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-69247" }, "action_statement": "Vulnerability CVE-2026-69247 affects version 43.0.3.post5+tuxcare of cryptography." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69248 affects version 43.0.3.post5+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-69248" }, "action_statement": "Vulnerability CVE-2026-69248 affects version 43.0.3.post5+tuxcare of cryptography." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69249 is fixed in version 43.0.3.post5+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-69249" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-537c-gmf6-5ccf is fixed in version 43.0.3.post5+tuxcare of cryptography.", "vulnerability": { "name": "GHSA-537c-gmf6-5ccf" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post5+tuxcare" } } ], "timestamp": "2026-10-29T16:38:31.252565+00:00", "status_notes": "Vulnerability GHSA-5cpq-8wj7-hf2v does not affect version 43.0.3.post5+tuxcare of cryptography. not_affected \u2014 The target version cryptography 43.0.3 is NOT affected by GHSA-5cpq-8wj7-hf2v. This CVE affects cryptography versions 0.5-40.0.2 that bundled vulnerable OpenSSL versions in their wheels. The vulnerability was fixed in upstream version 41.0.0 (released 2023-05-30) by updating the bundled OpenSSL to version 3.1.1. The target version 43.0.3 is well beyond the vulnerable range and ships with OpenSS...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-5cpq-8wj7-hf2v" }, "impact_statement": "not_affected \u2014 The target version cryptography 43.0.3 is NOT affected by GHSA-5cpq-8wj7-hf2v. This CVE affects cryptography versions 0.5-40.0.2 that bundled vulnerable OpenSSL versions in their wheels. The vulnerability was fixed in upstream version 41.0.0 (released 2023-05-30) by updating the bundled OpenSSL to version 3.1.1. The target version 43.0.3 is well beyond the vulnerable range and ships with OpenSS..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post5+tuxcare" } } ], "timestamp": "2026-10-29T16:02:14.489752+00:00", "status_notes": "Vulnerability GHSA-h4gh-qq45-vh27 does not affect version 43.0.3.post5+tuxcare of cryptography. not_affected \u2014 The target (cryptography 43.0.3.post5+tuxcare) is not affected by GHSA-h4gh-qq45-vh27 (OpenSSL CVE-2024-6119). The vulnerability affects OpenSSL versions bundled in cryptography wheels 37.0.0-43.0.0. The upstream fix (updating to OpenSSL 3.3.2) was released in cryptography 43.0.1 and is present in the target's git history as commit a7733878 authored by upstream maintainer Paul Kehrer. This fix ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-h4gh-qq45-vh27" }, "impact_statement": "not_affected \u2014 The target (cryptography 43.0.3.post5+tuxcare) is not affected by GHSA-h4gh-qq45-vh27 (OpenSSL CVE-2024-6119). The vulnerability affects OpenSSL versions bundled in cryptography wheels 37.0.0-43.0.0. The upstream fix (updating to OpenSSL 3.3.2) was released in cryptography 43.0.1 and is present in the target's git history as commit a7733878 authored by upstream maintainer Paul Kehrer. This fix ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post5+tuxcare" } } ], "timestamp": "2026-10-29T16:04:48.394138+00:00", "status_notes": "Vulnerability GHSA-jm77-qphf-c4w8 does not affect version 43.0.3.post5+tuxcare of cryptography. not_affected \u2014 Target version 43.0.3.post5+tuxcare is NOT affected by GHSA-jm77-qphf-c4w8. The CVE explicitly states the affected version range is \"cryptography 0.8-41.0.2\" (wheels bundling vulnerable OpenSSL < 3.1.2). The target version 43.0.3 was released in October 2024, 14 months after the fix (version 41.0.3, August 2023), and inherently bundles OpenSSL 3.3.2 or later, which already contains fixes for th...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jm77-qphf-c4w8" }, "impact_statement": "not_affected \u2014 Target version 43.0.3.post5+tuxcare is NOT affected by GHSA-jm77-qphf-c4w8. The CVE explicitly states the affected version range is \"cryptography 0.8-41.0.2\" (wheels bundling vulnerable OpenSSL < 3.1.2). The target version 43.0.3 was released in October 2024, 14 months after the fix (version 41.0.3, August 2023), and inherently bundles OpenSSL 3.3.2 or later, which already contains fixes for th..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post5+tuxcare" } } ], "timestamp": "2026-10-29T16:31:42.930543+00:00", "status_notes": "Vulnerability GHSA-v8gr-m533-ghj9 does not affect version 43.0.3.post5+tuxcare of cryptography. not_affected \u2014 Target version 43.0.3.post5+tuxcare is not affected by GHSA-v8gr-m533-ghj9 (CVE-2023-4807). This vulnerability affects OpenSSL versions bundled in cryptography wheels \u226441.0.3. The vulnerability is in OpenSSL (POLY1305 MAC XMM register corruption on Windows), not in cryptography's own code. The target: (1) is version 43.0.3, well after the fixed version 41.0.4 released 2023-09-19, (2) builds whe...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-v8gr-m533-ghj9" }, "impact_statement": "not_affected \u2014 Target version 43.0.3.post5+tuxcare is not affected by GHSA-v8gr-m533-ghj9 (CVE-2023-4807). This vulnerability affects OpenSSL versions bundled in cryptography wheels \u226441.0.3. The vulnerability is in OpenSSL (POLY1305 MAC XMM register corruption on Windows), not in cryptography's own code. The target: (1) is version 43.0.3, well after the fixed version 41.0.4 released 2023-09-19, (2) builds whe..." } ] }