{ "@id": "urn:uuid:10925efb-671f-4905-a04f-222b501be768", "role": "Document Creator", "author": "https://tuxcare.com", "version": 12, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-10-29T16:41:00.784384+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post2+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2023-0286 affects version 44.0.3.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-0286" }, "action_statement": "Vulnerability CVE-2023-0286 affects version 44.0.3.post2+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post2+tuxcare" } } ], "timestamp": "2026-10-29T16:14:52.980486+00:00", "status_notes": "Vulnerability CVE-2023-23931 does not affect version 44.0.3.post2+tuxcare of cryptography. not_affected \u2014 CVE-2023-23931 is not present in cryptography 44.0.3. The vulnerability was fixed in upstream commit 9fbf84efc (2023-02-07) which added require_writable=True to prevent mutation of immutable buffers. This fix was already present in the upstream release that TuxCare onboarded. Additionally, the vulnerable Python implementation was completely replaced by a Rust implementation in commit 50ea0faab ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-23931" }, "impact_statement": "not_affected \u2014 CVE-2023-23931 is not present in cryptography 44.0.3. The vulnerability was fixed in upstream commit 9fbf84efc (2023-02-07) which added require_writable=True to prevent mutation of immutable buffers. This fix was already present in the upstream release that TuxCare onboarded. Additionally, the vulnerable Python implementation was completely replaced by a Rust implementation in commit 50ea0faab ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:25:38.085266+00:00", "status_notes": "Vulnerability CVE-2023-38325 affects version 44.0.3.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-38325" }, "action_statement": "Vulnerability CVE-2023-38325 affects version 44.0.3.post2+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post2+tuxcare" } } ], "timestamp": "2026-10-29T16:26:12.093924+00:00", "status_notes": "Vulnerability CVE-2023-49083 does not affect version 44.0.3.post2+tuxcare of cryptography. not_affected \u2014 Target version 44.0.3 is NOT AFFECTED by CVE-2023-49083. The vulnerable Python/CFFI implementation no longer exists; the upstream fix (commit 1e7b4d074 by alex.gaynor@gmail.com, Nov 27 2023) shipped in the upstream release before TuxCare onboarded this version. Additionally, the PKCS7 certificate loading code was later migrated to Rust (Jan 22 2024), which uses safe Option/Result patterns that ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-49083" }, "impact_statement": "not_affected \u2014 Target version 44.0.3 is NOT AFFECTED by CVE-2023-49083. The vulnerable Python/CFFI implementation no longer exists; the upstream fix (commit 1e7b4d074 by alex.gaynor@gmail.com, Nov 27 2023) shipped in the upstream release before TuxCare onboarded this version. Additionally, the PKCS7 certificate loading code was later migrated to Rust (Jan 22 2024), which uses safe Option/Result patterns that ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post2+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2023-50782 affects version 44.0.3.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-50782" }, "action_statement": "Vulnerability CVE-2023-50782 affects version 44.0.3.post2+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post2+tuxcare" } } ], "timestamp": "2026-10-29T16:19:51.534017+00:00", "status_notes": "Vulnerability CVE-2024-0727 does not affect version 44.0.3.post2+tuxcare of cryptography. not_affected \u2014 The target (cryptography 44.0.3.post4+tuxcare) is not vulnerable to CVE-2024-0727. While the cryptography library does process PKCS12 files and calls OpenSSL's vulnerable PKCS12_parse() functions via Rust bindings (src/rust/src/pkcs12.rs:726-741), the bundled OpenSSL 3.4.6 contains the fix for this vulnerability. CVE-2024-0727 was fixed in OpenSSL 3.2.1/3.1.5/3.0.13 (released Jan 30, 2024), and...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-0727" }, "impact_statement": "not_affected \u2014 The target (cryptography 44.0.3.post4+tuxcare) is not vulnerable to CVE-2024-0727. While the cryptography library does process PKCS12 files and calls OpenSSL's vulnerable PKCS12_parse() functions via Rust bindings (src/rust/src/pkcs12.rs:726-741), the bundled OpenSSL 3.4.6 contains the fix for this vulnerability. CVE-2024-0727 was fixed in OpenSSL 3.2.1/3.1.5/3.0.13 (released Jan 30, 2024), and..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post2+tuxcare" } } ], "timestamp": "2026-10-29T16:24:37.696326+00:00", "status_notes": "Vulnerability CVE-2024-12797 does not affect version 44.0.3.post2+tuxcare of cryptography. not_affected \u2014 CVE-2024-12797 affects pyca/cryptography versions 42.0.0-44.0.0 due to vulnerable OpenSSL bundled in wheels. Target version 44.0.3.post4+tuxcare is outside this range. Upstream released 44.0.1 on 2025-02-11 (same day as OpenSSL advisory 20250211.txt) with OpenSSL 3.4.1, removing the vulnerability. Version 44.0.3 inherited this fix. TuxCare's build currently uses OpenSSL 3.4.6 (even newer). The ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-12797" }, "impact_statement": "not_affected \u2014 CVE-2024-12797 affects pyca/cryptography versions 42.0.0-44.0.0 due to vulnerable OpenSSL bundled in wheels. Target version 44.0.3.post4+tuxcare is outside this range. Upstream released 44.0.1 on 2025-02-11 (same day as OpenSSL advisory 20250211.txt) with OpenSSL 3.4.1, removing the vulnerability. Version 44.0.3 inherited this fix. TuxCare's build currently uses OpenSSL 3.4.6 (even newer). The ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:00:55.169132+00:00", "status_notes": "Vulnerability CVE-2024-26130 affects version 44.0.3.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2024-26130" }, "action_statement": "Vulnerability CVE-2024-26130 affects version 44.0.3.post2+tuxcare of cryptography." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-26007 is fixed in version 44.0.3.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-26007" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34073 affects version 44.0.3.post2+tuxcare of cryptography, and is fixed in 44.0.3.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-34073" }, "action_statement": "Vulnerability CVE-2026-34073 affects version 44.0.3.post2+tuxcare of cryptography, and is fixed in 44.0.3.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2026-39892 affects version 44.0.3.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-39892" }, "action_statement": "Vulnerability CVE-2026-39892 affects version 44.0.3.post2+tuxcare of cryptography." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69247 affects version 44.0.3.post2+tuxcare of cryptography, and is fixed in 44.0.3.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-69247" }, "action_statement": "Vulnerability CVE-2026-69247 affects version 44.0.3.post2+tuxcare of cryptography, and is fixed in 44.0.3.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69248 affects version 44.0.3.post2+tuxcare of cryptography, and is fixed in 44.0.3.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-69248" }, "action_statement": "Vulnerability CVE-2026-69248 affects version 44.0.3.post2+tuxcare of cryptography, and is fixed in 44.0.3.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69249 affects version 44.0.3.post2+tuxcare of cryptography, and is fixed in 44.0.3.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-69249" }, "action_statement": "Vulnerability CVE-2026-69249 affects version 44.0.3.post2+tuxcare of cryptography, and is fixed in 44.0.3.post4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-537c-gmf6-5ccf is fixed in version 44.0.3.post2+tuxcare of cryptography.", "vulnerability": { "name": "GHSA-537c-gmf6-5ccf" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post2+tuxcare" } } ], "timestamp": "2026-10-29T16:41:00.784384+00:00", "status_notes": "Vulnerability GHSA-5cpq-8wj7-hf2v does not affect version 44.0.3.post2+tuxcare of cryptography. not_affected \u2014 Target version 44.0.3 is not affected by GHSA-5cpq-8wj7-hf2v (OpenSSL CVE-2023-2650). The CVE affected cryptography versions 0.5-40.0.2 that bundled vulnerable OpenSSL versions. The target bundles OpenSSL 3.4.6 (per ci/scripts/install_openssl.sh:13), which is newer than the fixed versions (1.1.1u, 3.0.9, 3.1.1) and does not contain the CVE-2023-2650 vulnerability. The vulnerable OpenSSL code is...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-5cpq-8wj7-hf2v" }, "impact_statement": "not_affected \u2014 Target version 44.0.3 is not affected by GHSA-5cpq-8wj7-hf2v (OpenSSL CVE-2023-2650). The CVE affected cryptography versions 0.5-40.0.2 that bundled vulnerable OpenSSL versions. The target bundles OpenSSL 3.4.6 (per ci/scripts/install_openssl.sh:13), which is newer than the fixed versions (1.1.1u, 3.0.9, 3.1.1) and does not contain the CVE-2023-2650 vulnerability. The vulnerable OpenSSL code is..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post2+tuxcare" } } ], "timestamp": "2026-10-29T16:04:48.394138+00:00", "status_notes": "Vulnerability GHSA-h4gh-qq45-vh27 does not affect version 44.0.3.post2+tuxcare of cryptography. not_affected \u2014 The target version (44.0.3.post4+tuxcare) is not affected by CVE-2024-6119/GHSA-h4gh-qq45-vh27. This vulnerability exists in OpenSSL versions 3.0-3.3.1 and was fixed in OpenSSL 3.3.2. The target builds with OpenSSL 3.4.6 (per ci/scripts/install_openssl.sh), which is significantly newer than the fixed version and does not contain the vulnerability. The affected cryptography version range is 37.0...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-h4gh-qq45-vh27" }, "impact_statement": "not_affected \u2014 The target version (44.0.3.post4+tuxcare) is not affected by CVE-2024-6119/GHSA-h4gh-qq45-vh27. This vulnerability exists in OpenSSL versions 3.0-3.3.1 and was fixed in OpenSSL 3.3.2. The target builds with OpenSSL 3.4.6 (per ci/scripts/install_openssl.sh), which is significantly newer than the fixed version and does not contain the vulnerability. The affected cryptography version range is 37.0..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post2+tuxcare" } } ], "timestamp": "2026-10-29T16:09:39.325728+00:00", "status_notes": "Vulnerability GHSA-jm77-qphf-c4w8 does not affect version 44.0.3.post2+tuxcare of cryptography. not_affected \u2014 The target version (44.0.3.post4+tuxcare) is not affected by GHSA-jm77-qphf-c4w8. This CVE affects pyca/cryptography versions 0.8-41.0.2 due to vulnerable OpenSSL versions bundled in the wheels. The fix was introduced in version 41.0.3 (OpenSSL 3.1.2). The target version 44.0.3 ships with OpenSSL 3.4.1 (introduced in upstream version 44.0.1), which is much newer and includes all fixes for CVE-2...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jm77-qphf-c4w8" }, "impact_statement": "not_affected \u2014 The target version (44.0.3.post4+tuxcare) is not affected by GHSA-jm77-qphf-c4w8. This CVE affects pyca/cryptography versions 0.8-41.0.2 due to vulnerable OpenSSL versions bundled in the wheels. The fix was introduced in version 41.0.3 (OpenSSL 3.1.2). The target version 44.0.3 ships with OpenSSL 3.4.1 (introduced in upstream version 44.0.1), which is much newer and includes all fixes for CVE-2..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post2+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability GHSA-v8gr-m533-ghj9 affects version 44.0.3.post2+tuxcare of cryptography.", "vulnerability": { "name": "GHSA-v8gr-m533-ghj9" }, "action_statement": "Vulnerability GHSA-v8gr-m533-ghj9 affects version 44.0.3.post2+tuxcare of cryptography." } ] }