{ "@id": "urn:uuid:acc40ede-8828-4935-9bb3-a67de51badd4", "role": "Document Creator", "author": "https://tuxcare.com", "version": 14, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-10-29T22:58:00.157057+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@46.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@46.0.7.post1+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2023-0286 affects version 46.0.7.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-0286" }, "action_statement": "Vulnerability CVE-2023-0286 affects version 46.0.7.post1+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@46.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@46.0.7.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:14:06.675817+00:00", "status_notes": "Vulnerability CVE-2023-23931 does not affect version 46.0.7.post1+tuxcare of cryptography. not_affected \u2014 CVE-2023-23931 is NOT present in cryptography 46.0.7. The vulnerability (allowing `Cipher.update_into()` to mutate immutable buffers) was fixed in upstream commit 9fbf84efc (Feb 2023) by adding `require_writable=True` to buffer validation. This fix shipped in the upstream release before TuxCare onboarding. In version 46.0.7, the cipher implementation uses Rust, where the equivalent fix is prese...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-23931" }, "impact_statement": "not_affected \u2014 CVE-2023-23931 is NOT present in cryptography 46.0.7. The vulnerability (allowing `Cipher.update_into()` to mutate immutable buffers) was fixed in upstream commit 9fbf84efc (Feb 2023) by adding `require_writable=True` to buffer validation. This fix shipped in the upstream release before TuxCare onboarding. In version 46.0.7, the cipher implementation uses Rust, where the equivalent fix is prese..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@46.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@46.0.7.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:25:38.085266+00:00", "status_notes": "Vulnerability CVE-2023-38325 affects version 46.0.7.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-38325" }, "action_statement": "Vulnerability CVE-2023-38325 affects version 46.0.7.post1+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@46.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@46.0.7.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:28:53.758396+00:00", "status_notes": "Vulnerability CVE-2023-49083 does not affect version 46.0.7.post1+tuxcare of cryptography. not_affected \u2014 Version 46.0.7 is not affected by CVE-2023-49083. The vulnerability (NULL-pointer dereference in PKCS7 certificate loading) existed in the Python/OpenSSL backend implementation used in versions prior to 41.0.6. Version 46.0.7 uses a completely different architecture: PKCS7 functionality is implemented in Rust (src/rust/src/pkcs7.rs) using memory-safe Option types. The malicious input (PKCS7 wit...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2023-49083" }, "impact_statement": "not_affected \u2014 Version 46.0.7 is not affected by CVE-2023-49083. The vulnerability (NULL-pointer dereference in PKCS7 certificate loading) existed in the Python/OpenSSL backend implementation used in versions prior to 41.0.6. Version 46.0.7 uses a completely different architecture: PKCS7 functionality is implemented in Rust (src/rust/src/pkcs7.rs) using memory-safe Option types. The malicious input (PKCS7 wit..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@46.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@46.0.7.post1+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2023-50782 affects version 46.0.7.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-50782" }, "action_statement": "Vulnerability CVE-2023-50782 affects version 46.0.7.post1+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@46.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@46.0.7.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:19:51.534017+00:00", "status_notes": "Vulnerability CVE-2024-0727 does not affect version 46.0.7.post1+tuxcare of cryptography. not_affected \u2014 CVE-2024-0727 is an OpenSSL vulnerability, not a pyca/cryptography vulnerability. The target repository (pyca/cryptography 46.0.7) does not contain OpenSSL source code\u2014it declares OpenSSL as a dependency via Rust FFI bindings. The vulnerable PKCS12 parsing code lives in the OpenSSL C library, not in this repository. The upstream patch only updated CI to test against patched OpenSSL versions (no...", "vulnerability": { "name": "CVE-2024-0727" }, "impact_statement": "not_affected \u2014 CVE-2024-0727 is an OpenSSL vulnerability, not a pyca/cryptography vulnerability. The target repository (pyca/cryptography 46.0.7) does not contain OpenSSL source code\u2014it declares OpenSSL as a dependency via Rust FFI bindings. The vulnerable PKCS12 parsing code lives in the OpenSSL C library, not in this repository. The upstream patch only updated CI to test against patched OpenSSL versions (no..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@46.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@46.0.7.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:24:37.696326+00:00", "status_notes": "Vulnerability CVE-2024-12797 does not affect version 46.0.7.post1+tuxcare of cryptography. not_affected \u2014 CVE-2024-12797 affects pyca/cryptography 42.0.0-44.0.0 due to a vulnerability in the statically linked OpenSSL (versions 3.2.0-3.4.1) bundled in their wheels. The vulnerability involves OpenSSL's Raw Public Keys (RPKs) for server authentication, allowing MITM attacks when TLS/DTLS handshakes fail to abort on authentication failures. The target version 46.0.7.post3+tuxcare is outside the vulnera...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-12797" }, "impact_statement": "not_affected \u2014 CVE-2024-12797 affects pyca/cryptography 42.0.0-44.0.0 due to a vulnerability in the statically linked OpenSSL (versions 3.2.0-3.4.1) bundled in their wheels. The vulnerability involves OpenSSL's Raw Public Keys (RPKs) for server authentication, allowing MITM attacks when TLS/DTLS handshakes fail to abort on authentication failures. The target version 46.0.7.post3+tuxcare is outside the vulnera..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@46.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@46.0.7.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:00:55.169132+00:00", "status_notes": "Vulnerability CVE-2024-26130 affects version 46.0.7.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2024-26130" }, "action_statement": "Vulnerability CVE-2024-26130 affects version 46.0.7.post1+tuxcare of cryptography." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@46.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@46.0.7.post1+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2026-26007 affects version 46.0.7.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-26007" }, "action_statement": "Vulnerability CVE-2026-26007 affects version 46.0.7.post1+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@46.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@46.0.7.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:19:27.667174+00:00", "status_notes": "Vulnerability CVE-2026-34073 does not affect version 46.0.7.post1+tuxcare of cryptography. not_affected \u2014 The target repository at version 46.0.7.post3+tuxcare is NOT AFFECTED by CVE-2026-34073. The fix for this vulnerability was already present in the upstream 46.0.7 release (commit 91d728897, authored by William Woodruff on 2026-03-25) that TuxCare onboarded. The vulnerable pattern (improper handling of wildcard DNS SANs against name constraints) has been removed. The target contains an even more...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-34073" }, "impact_statement": "not_affected \u2014 The target repository at version 46.0.7.post3+tuxcare is NOT AFFECTED by CVE-2026-34073. The fix for this vulnerability was already present in the upstream 46.0.7 release (commit 91d728897, authored by William Woodruff on 2026-03-25) that TuxCare onboarded. The vulnerable pattern (improper handling of wildcard DNS SANs against name constraints) has been removed. The target contains an even more..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@46.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@46.0.7.post1+tuxcare" } } ], "timestamp": "2026-10-29T22:58:00.157057+00:00", "status_notes": "Vulnerability CVE-2026-39892 does not affect version 46.0.7.post1+tuxcare of cryptography. not_affected \u2014 The target repository (cryptography 46.0.7.post3+tuxcare) is not affected by CVE-2026-39892. The vulnerability involves buffer overflows when non-contiguous Python buffers are passed to APIs like Hash.update() on Python 3.11+. The fix (contiguity check in _extract_buffer_length) is present in the target code at src/rust/src/buf.rs lines 41-45. This fix was included in the upstream 46.0.7 releas...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-39892" }, "impact_statement": "not_affected \u2014 The target repository (cryptography 46.0.7.post3+tuxcare) is not affected by CVE-2026-39892. The vulnerability involves buffer overflows when non-contiguous Python buffers are passed to APIs like Hash.update() on Python 3.11+. The fix (contiguity check in _extract_buffer_length) is present in the target code at src/rust/src/buf.rs lines 41-45. This fix was included in the upstream 46.0.7 releas..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@46.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@46.0.7.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69247 affects version 46.0.7.post1+tuxcare of cryptography, and is fixed in 46.0.7.post2+tuxcare.", "vulnerability": { "name": "CVE-2026-69247" }, "action_statement": "Vulnerability CVE-2026-69247 affects version 46.0.7.post1+tuxcare of cryptography, and is fixed in 46.0.7.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@46.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@46.0.7.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69248 affects version 46.0.7.post1+tuxcare of cryptography, and is fixed in 46.0.7.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-69248" }, "action_statement": "Vulnerability CVE-2026-69248 affects version 46.0.7.post1+tuxcare of cryptography, and is fixed in 46.0.7.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@46.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@46.0.7.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69249 affects version 46.0.7.post1+tuxcare of cryptography, and is fixed in 46.0.7.post2+tuxcare.", "vulnerability": { "name": "CVE-2026-69249" }, "action_statement": "Vulnerability CVE-2026-69249 affects version 46.0.7.post1+tuxcare of cryptography, and is fixed in 46.0.7.post2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@46.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@46.0.7.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-537c-gmf6-5ccf is fixed in version 46.0.7.post1+tuxcare of cryptography.", "vulnerability": { "name": "GHSA-537c-gmf6-5ccf" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@46.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@46.0.7.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:41:00.784384+00:00", "status_notes": "Vulnerability GHSA-5cpq-8wj7-hf2v does not affect version 46.0.7.post1+tuxcare of cryptography. not_affected \u2014 Target version 46.0.7 is not affected by CVE-2023-2650/GHSA-5cpq-8wj7-hf2v. The vulnerability concerns bundled OpenSSL versions in cryptography wheels for versions 0.5-40.0.2. The upstream fix (commit 8708245cc) updated bundled OpenSSL to patched versions (1.1.1u, 3.0.9, 3.1.1) and was already present in upstream release 46.0.7 before TuxCare onboarded this version. Current CI configuration use...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-5cpq-8wj7-hf2v" }, "impact_statement": "not_affected \u2014 Target version 46.0.7 is not affected by CVE-2023-2650/GHSA-5cpq-8wj7-hf2v. The vulnerability concerns bundled OpenSSL versions in cryptography wheels for versions 0.5-40.0.2. The upstream fix (commit 8708245cc) updated bundled OpenSSL to patched versions (1.1.1u, 3.0.9, 3.1.1) and was already present in upstream release 46.0.7 before TuxCare onboarded this version. Current CI configuration use..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@46.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@46.0.7.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:03:40.491421+00:00", "status_notes": "Vulnerability GHSA-h4gh-qq45-vh27 does not affect version 46.0.7.post1+tuxcare of cryptography. not_affected \u2014 The target version cryptography 46.0.7.post3+tuxcare is not affected by GHSA-h4gh-qq45-vh27. This CVE concerns OpenSSL CVE-2024-6119 (denial of service via malformed X.509 otherName SANs) that was bundled in cryptography wheels versions 37.0.0-43.0.0. The vulnerability was fixed in cryptography 43.0.1 by rebuilding wheels with OpenSSL 3.3.2+. The target version 46.0.7 (released 2026-01-27) bund...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-h4gh-qq45-vh27" }, "impact_statement": "not_affected \u2014 The target version cryptography 46.0.7.post3+tuxcare is not affected by GHSA-h4gh-qq45-vh27. This CVE concerns OpenSSL CVE-2024-6119 (denial of service via malformed X.509 otherName SANs) that was bundled in cryptography wheels versions 37.0.0-43.0.0. The vulnerability was fixed in cryptography 43.0.1 by rebuilding wheels with OpenSSL 3.3.2+. The target version 46.0.7 (released 2026-01-27) bund..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@46.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@46.0.7.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:14:06.675817+00:00", "status_notes": "Vulnerability GHSA-jm77-qphf-c4w8 does not affect version 46.0.7.post1+tuxcare of cryptography. not_affected \u2014 Target version 46.0.7 is not affected by GHSA-jm77-qphf-c4w8. This CVE concerns vulnerable OpenSSL versions (<3.1.2) statically linked in cryptography's binary wheels for versions 0.8-41.0.2. The vulnerability is NOT in cryptography's Python/Rust source code but in the bundled OpenSSL library. Version 46.0.7 is far beyond the affected range (41.0.2), and both the upstream release and TuxCare...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jm77-qphf-c4w8" }, "impact_statement": "not_affected \u2014 Target version 46.0.7 is not affected by GHSA-jm77-qphf-c4w8. This CVE concerns vulnerable OpenSSL versions (<3.1.2) statically linked in cryptography's binary wheels for versions 0.8-41.0.2. The vulnerability is NOT in cryptography's Python/Rust source code but in the bundled OpenSSL library. Version 46.0.7 is far beyond the affected range (41.0.2), and both the upstream release and TuxCare..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@46.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@46.0.7.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:33:45.788916+00:00", "status_notes": "Vulnerability GHSA-v8gr-m533-ghj9 does not affect version 46.0.7.post1+tuxcare of cryptography. not_affected \u2014 The target version (46.0.7.post3+tuxcare) is not affected by GHSA-v8gr-m533-ghj9. This CVE concerns vulnerable OpenSSL versions bundled in cryptography wheels for versions 2.5-41.0.3. The target version 46.0.7 is significantly newer than the affected range and inherited the fix (OpenSSL 3.1.3+) from its upstream release. The vulnerability is in the bundled OpenSSL dependency distributed in whee...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-v8gr-m533-ghj9" }, "impact_statement": "not_affected \u2014 The target version (46.0.7.post3+tuxcare) is not affected by GHSA-v8gr-m533-ghj9. This CVE concerns vulnerable OpenSSL versions bundled in cryptography wheels for versions 2.5-41.0.3. The target version 46.0.7 is significantly newer than the affected range and inherited the fix (OpenSSL 3.1.3+) from its upstream release. The vulnerability is in the bundled OpenSSL dependency distributed in whee..." } ] }