Cryptography Io
Monthly
Private-key information disclosure in the pyca/cryptography Python package (versions <= 46.0.4) arises because public-key loading and construction routines skip prime-order subgroup validation for SECT binary elliptic curves, letting an attacker submit a small-order point that leaks bits of a victim's private key during ECDH or enables signature forgery in ECDSA. Per the CVSS vector exploitation is unauthenticated and network-reachable (PR:N/AV:N) but high-complexity (AC:H), and only the rarely used SECT/binary curves are affected. There is no public exploit identified at time of analysis, EPSS risk is negligible (0.01%), and a fix is available in 46.0.5.
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This NULL Pointer Dereference vulnerability could allow attackers to crash the application by dereferencing a null pointer.
A flaw was found in the python-cryptography package. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
The cryptography package before 41.0.2 for Python mishandles SSH certificates that have critical options. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
HKDF in cryptography before 1.5.2 returns an empty byte-string if used with a length less than algorithm.digest_size. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Private-key information disclosure in the pyca/cryptography Python package (versions <= 46.0.4) arises because public-key loading and construction routines skip prime-order subgroup validation for SECT binary elliptic curves, letting an attacker submit a small-order point that leaks bits of a victim's private key during ECDH or enables signature forgery in ECDSA. Per the CVSS vector exploitation is unauthenticated and network-reachable (PR:N/AV:N) but high-complexity (AC:H), and only the rarely used SECT/binary curves are affected. There is no public exploit identified at time of analysis, EPSS risk is negligible (0.01%), and a fix is available in 46.0.5.
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This NULL Pointer Dereference vulnerability could allow attackers to crash the application by dereferencing a null pointer.
A flaw was found in the python-cryptography package. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
The cryptography package before 41.0.2 for Python mishandles SSH certificates that have critical options. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
HKDF in cryptography before 1.5.2 returns an empty byte-string if used with a length less than algorithm.digest_size. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.