CVE-2020-36242

Advisory

Oci 2.37.0 updates the 'cryptography' dependency version to 3.3.2 to address a security vulnerability.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

====================

Added
-----
* Support for opting in/out of live migration on instances in the Compute service
* Support for enabling/disabling Operations Insights on external non-container and external pluggable databases in the Database service
* Support for a GraphStudio URL as a connection URL on databases in the Database service
* Support for adding customer contacts on autonomous databases in the Database service
* Support for name annotations on harvested objects in the Data Catalog service

Changed
-------
* If retries are enabled, the SDK will now retry on status 409/IncorrectState. It will not retry on status 501.

Breaking
--------
* Bumped cryptography version to 3.3.2 to address security vulnerability https://github.com/oracle/oci-python-sdk/pull/322

====================

Resources

• https://pypi.org/project/oci
• https://pyup.io/changelogs/oci/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36242