{ "@id": "urn:uuid:1d23fe93-522c-4cfe-8262-a6f3dfca4b2d", "role": "Document Creator", "author": "https://tuxcare.com", "version": 12, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-10-29T16:41:00.784384+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post3+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2023-0286 affects version 45.0.7.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-0286" }, "action_statement": "Vulnerability CVE-2023-0286 affects version 45.0.7.post3+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post3+tuxcare" } } ], "timestamp": "2026-10-29T16:14:52.980486+00:00", "status_notes": "Vulnerability CVE-2023-23931 does not affect version 45.0.7.post3+tuxcare of cryptography. not_affected \u2014 CVE-2023-23931 is NOT present in cryptography 45.0.7. The vulnerable Python CFFI backend (src/cryptography/hazmat/backends/openssl/ciphers.py) that allowed immutable buffers in update_into() has been completely replaced with a Rust implementation that enforces buffer writability. The fix was introduced by upstream commit 50ea0faab70 (Feb 2024, author: alex.gaynor@gmail.com) which migrated symme...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-23931" }, "impact_statement": "not_affected \u2014 CVE-2023-23931 is NOT present in cryptography 45.0.7. The vulnerable Python CFFI backend (src/cryptography/hazmat/backends/openssl/ciphers.py) that allowed immutable buffers in update_into() has been completely replaced with a Rust implementation that enforces buffer writability. The fix was introduced by upstream commit 50ea0faab70 (Feb 2024, author: alex.gaynor@gmail.com) which migrated symme..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:25:38.085266+00:00", "status_notes": "Vulnerability CVE-2023-38325 affects version 45.0.7.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-38325" }, "action_statement": "Vulnerability CVE-2023-38325 affects version 45.0.7.post3+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post3+tuxcare" } } ], "timestamp": "2026-10-29T16:25:32.301563+00:00", "status_notes": "Vulnerability CVE-2023-49083 does not affect version 45.0.7.post3+tuxcare of cryptography. not_affected \u2014 CVE-2023-49083: Target version 45.0.7 is not affected. The vulnerability existed in Python code that directly accessed OpenSSL C structures via FFI without NULL-pointer validation. Version 45.0.7 uses a Rust implementation (migrated upstream in Jan 2024, commit 41daf2d86) that handles PKCS7 parsing through safe abstractions (Option types). When the malicious input (PKCS7 with NULL signed data p...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2023-49083" }, "impact_statement": "not_affected \u2014 CVE-2023-49083: Target version 45.0.7 is not affected. The vulnerability existed in Python code that directly accessed OpenSSL C structures via FFI without NULL-pointer validation. Version 45.0.7 uses a Rust implementation (migrated upstream in Jan 2024, commit 41daf2d86) that handles PKCS7 parsing through safe abstractions (Option types). When the malicious input (PKCS7 with NULL signed data p..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post3+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2023-50782 affects version 45.0.7.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-50782" }, "action_statement": "Vulnerability CVE-2023-50782 affects version 45.0.7.post3+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post3+tuxcare" } } ], "timestamp": "2026-10-29T16:19:27.667174+00:00", "status_notes": "Vulnerability CVE-2024-0727 does not affect version 45.0.7.post3+tuxcare of cryptography. not_affected \u2014 The target version (cryptography 45.0.7.post4+tuxcare) bundles OpenSSL 3.5.2 in its wheel distributions, which already contains the fix for CVE-2024-0727. The vulnerability is in OpenSSL's PKCS12 parsing functions (PKCS12_parse, etc.) where NULL pointer checks were missing. OpenSSL versions 3.2.1, 3.1.5, and 3.0.13 (released January 2024) fixed this issue. The target's bundled OpenSSL 3.5.2 (re...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-0727" }, "impact_statement": "not_affected \u2014 The target version (cryptography 45.0.7.post4+tuxcare) bundles OpenSSL 3.5.2 in its wheel distributions, which already contains the fix for CVE-2024-0727. The vulnerability is in OpenSSL's PKCS12 parsing functions (PKCS12_parse, etc.) where NULL pointer checks were missing. OpenSSL versions 3.2.1, 3.1.5, and 3.0.13 (released January 2024) fixed this issue. The target's bundled OpenSSL 3.5.2 (re..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post3+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2024-12797 does not affect version 45.0.7.post3+tuxcare of cryptography. Not affected: CVE-2024-12797 affects OpenSSL 3.2.0-3.2.3, 3.3.0-3.3.2 and 3.4.0 (RFC7250 Raw Public Keys). All published cryptography 45.0.7 wheels (post1-post4) were checked in Nexus: manylinux2014 wheels bundle OpenSSL 3.3.3, which contains the fix; manylinux_2_28 wheels bundle OpenSSL 1.1.1k, which has no RPK support. The earlier withdrawn state was set by mistake during onboarding; the CVE itself is valid (PATCHFLOW-1284).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-12797" }, "impact_statement": "Not affected: CVE-2024-12797 affects OpenSSL 3.2.0-3.2.3, 3.3.0-3.3.2 and 3.4.0 (RFC7250 Raw Public Keys). All published cryptography 45.0.7 wheels (post1-post4) were checked in Nexus: manylinux2014 wheels bundle OpenSSL 3.3.3, which contains the fix; manylinux_2_28 wheels bundle OpenSSL 1.1.1k, which has no RPK support. The earlier withdrawn state was set by mistake during onboarding; the CVE itself is valid (PATCHFLOW-1284)." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:00:55.169132+00:00", "status_notes": "Vulnerability CVE-2024-26130 affects version 45.0.7.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2024-26130" }, "action_statement": "Vulnerability CVE-2024-26130 affects version 45.0.7.post3+tuxcare of cryptography." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-26007 is fixed in version 45.0.7.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-26007" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34073 is fixed in version 45.0.7.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-34073" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-39892 is fixed in version 45.0.7.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-39892" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69247 affects version 45.0.7.post3+tuxcare of cryptography, and is fixed in 45.0.7.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-69247" }, "action_statement": "Vulnerability CVE-2026-69247 affects version 45.0.7.post3+tuxcare of cryptography, and is fixed in 45.0.7.post4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69248 is fixed in version 45.0.7.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-69248" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69249 affects version 45.0.7.post3+tuxcare of cryptography, and is fixed in 45.0.7.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-69249" }, "action_statement": "Vulnerability CVE-2026-69249 affects version 45.0.7.post3+tuxcare of cryptography, and is fixed in 45.0.7.post4+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-537c-gmf6-5ccf does not affect version 45.0.7.post3+tuxcare of cryptography. not_affected \u2014 The source repository does not contain OpenSSL source code. The vulnerability (GHSA-537c-gmf6-5ccf) affects OpenSSL bundled in binary wheels distributed on PyPI, not the cryptography source code itself. OpenSSL is downloaded and compiled during the wheel build process via build_openssl.sh, not present in the repository.", "vulnerability": { "name": "GHSA-537c-gmf6-5ccf" }, "impact_statement": "not_affected \u2014 The source repository does not contain OpenSSL source code. The vulnerability (GHSA-537c-gmf6-5ccf) affects OpenSSL bundled in binary wheels distributed on PyPI, not the cryptography source code itself. OpenSSL is downloaded and compiled during the wheel build process via build_openssl.sh, not present in the repository." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post3+tuxcare" } } ], "timestamp": "2026-10-29T16:41:00.784384+00:00", "status_notes": "Vulnerability GHSA-5cpq-8wj7-hf2v does not affect version 45.0.7.post3+tuxcare of cryptography. not_affected \u2014 CVE-2023-2650 is an OpenSSL vulnerability affecting cryptography's binary wheels that bundle vulnerable OpenSSL versions. The CVE explicitly states that cryptography versions 0.5-40.0.2 are vulnerable. The target version is 45.0.7.post4+tuxcare, which is well beyond the vulnerable range. Upstream cryptography 41.0.0 (released 2023-05-30) was the first version to bundle patched OpenSSL 3.1.1, an...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-5cpq-8wj7-hf2v" }, "impact_statement": "not_affected \u2014 CVE-2023-2650 is an OpenSSL vulnerability affecting cryptography's binary wheels that bundle vulnerable OpenSSL versions. The CVE explicitly states that cryptography versions 0.5-40.0.2 are vulnerable. The target version is 45.0.7.post4+tuxcare, which is well beyond the vulnerable range. Upstream cryptography 41.0.0 (released 2023-05-30) was the first version to bundle patched OpenSSL 3.1.1, an..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post3+tuxcare" } } ], "timestamp": "2026-10-29T16:03:20.676969+00:00", "status_notes": "Vulnerability GHSA-h4gh-qq45-vh27 does not affect version 45.0.7.post3+tuxcare of cryptography. not_affected \u2014 The target repository (cryptography 45.0.7.post4+tuxcare) is not affected by GHSA-h4gh-qq45-vh27 (OpenSSL CVE-2024-6119). This CVE concerns a vulnerability in OpenSSL's X.509 certificate name checking implementation, not in the cryptography library's code. The cryptography source repository contains only bindings to OpenSSL (CFFI declarations in Python and Rust FFI wrappers) but not the OpenSSL...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-h4gh-qq45-vh27" }, "impact_statement": "not_affected \u2014 The target repository (cryptography 45.0.7.post4+tuxcare) is not affected by GHSA-h4gh-qq45-vh27 (OpenSSL CVE-2024-6119). This CVE concerns a vulnerability in OpenSSL's X.509 certificate name checking implementation, not in the cryptography library's code. The cryptography source repository contains only bindings to OpenSSL (CFFI declarations in Python and Rust FFI wrappers) but not the OpenSSL..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post3+tuxcare" } } ], "timestamp": "2026-10-29T16:10:03.705151+00:00", "status_notes": "Vulnerability GHSA-jm77-qphf-c4w8 does not affect version 45.0.7.post3+tuxcare of cryptography. not_affected \u2014 Target version 45.0.7 was never affected by GHSA-jm77-qphf-c4w8. This CVE concerns vulnerable OpenSSL versions bundled in cryptography wheels for versions 0.8-41.0.2. The vulnerability was fixed in version 41.0.3 (August 2023) by upgrading to OpenSSL 3.1.2. Version 45.0.7 was released in September 2025, approximately 2 years after the fix, and bundles OpenSSL 3.5.2 (inherited from version 45.0....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jm77-qphf-c4w8" }, "impact_statement": "not_affected \u2014 Target version 45.0.7 was never affected by GHSA-jm77-qphf-c4w8. This CVE concerns vulnerable OpenSSL versions bundled in cryptography wheels for versions 0.8-41.0.2. The vulnerability was fixed in version 41.0.3 (August 2023) by upgrading to OpenSSL 3.1.2. Version 45.0.7 was released in September 2025, approximately 2 years after the fix, and bundles OpenSSL 3.5.2 (inherited from version 45.0...." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post3+tuxcare" } } ], "timestamp": "2026-10-29T16:32:48.378278+00:00", "status_notes": "Vulnerability GHSA-v8gr-m533-ghj9 does not affect version 45.0.7.post3+tuxcare of cryptography. not_affected \u2014 The target version (45.0.7.post4+tuxcare) is not affected by GHSA-v8gr-m533-ghj9. This CVE concerns vulnerable OpenSSL versions bundled in cryptography wheels for versions 2.5-41.0.3. The vulnerability was fixed in version 41.0.4 by upgrading to OpenSSL 3.1.3/3.0.11. The target version 45.0.7 is significantly newer (released ~2 years after the fix) and uses OpenSSL versions 3.5.0, 3.5.1, 3.4.1,...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-v8gr-m533-ghj9" }, "impact_statement": "not_affected \u2014 The target version (45.0.7.post4+tuxcare) is not affected by GHSA-v8gr-m533-ghj9. This CVE concerns vulnerable OpenSSL versions bundled in cryptography wheels for versions 2.5-41.0.3. The vulnerability was fixed in version 41.0.4 by upgrading to OpenSSL 3.1.3/3.0.11. The target version 45.0.7 is significantly newer (released ~2 years after the fix) and uses OpenSSL versions 3.5.0, 3.5.1, 3.4.1,..." } ] }