CVE-2023-38325

Advisory

The cryptography package before 41.0.2 for Python mishandles SSH certificates that have critical options.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

The cryptography package before 41.0.2 for Python mishandles SSH certificates that have critical options. See CVE-2023-38325.


MISC:https://github.com/pyca/cryptography/compare/41.0.1...41.0.2: https://github.com/pyca/cryptography/compare/41.0.1...41.0.2
MISC:https://github.com/pyca/cryptography/issues/9207: https://github.com/pyca/cryptography/issues/9207
MISC:https://github.com/pyca/cryptography/pull/9208: https://github.com/pyca/cryptography/pull/9208
MISC:https://pypi.org/project/cryptography/#history: https://pypi.org/project/cryptography/#history

Resources

• https://github.com/pyca/cryptography/compare/41.0.1...41.0.2
• https://github.com/pyca/cryptography/issues/9207
• https://github.com/pyca/cryptography/pull/9208
• https://pypi.org/project/cryptography/#history
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-38325
• https://security.netapp.com/advisory/ntap-20230824-0010/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NMCCTYY3CSNQBFFYYC5DAV6KATHWCUZK/