CVE-2023-6129

Advisory

Cassandra-medusa version 0.20.0 has upgraded its Cryptography dependency to version 42.0.2 from 35.0, in response to CVE-2023-6129.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

- Bump wheel from 0.32.3 to 0.38.1 (726) (dependabot)
- Bump cryptography from 42.0.2 to 42.0.4 (727) (dependabot)
- Change is_open function's log level messages from error to debug. (722) (philipfischbacher)
- Re-upload files if they are missing in storage (716) (rzvoncek)
- Fix GetBackupStatus endpoint on a fresh gRPC server (730) (rzvoncek)
- Update GRPC_HEALTH_PROBE_VERSION to version 0.4.25 (724) (AlexsandroRotundo)
- Update dependecies to resolve security vulnerabilities (717) (rzvoncek)
- Make grpc's AsynBackup truly Async (720) (rzvoncek)
- Switch to Poetry for dependency and build management (679) (rzvoncek)

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-6129
• https://github.com/thelastpickle/cassandra-medusa/pull/717/commits/b837ada2922aa74800e03a53cc369f0d00ff21ac