Cryptography
Monthly
Python's cryptography library prior to version 46.0.5 fails to validate that elliptic curve public key points belong to the expected prime-order subgroup, allowing attackers to supply crafted keys from small-order subgroups. This validation gap enables attackers to extract sensitive information about a victim's private key during ECDH key exchange or compromise ECDSA signature verification. Developers using affected key loading or generation functions should update to the patched version immediately.
Python's cryptography library prior to version 46.0.5 fails to validate that elliptic curve public key points belong to the expected prime-order subgroup, allowing attackers to supply crafted keys from small-order subgroups. This validation gap enables attackers to extract sensitive information about a victim's private key during ECDH key exchange or compromise ECDSA signature verification. Developers using affected key loading or generation functions should update to the patched version immediately.