Pyca
Monthly
Certificate path building in python-cryptography before 49.0.0 is exploitable as a denial-of-service vector by attackers who can supply crafted X.509 chains containing duplicate self-signed intermediate certificates. The Rust-based `build_chain_inner` function explores issuer candidates recursively without deduplicating previously analyzed entries, causing computational work to grow exponentially with the number of duplicates present - empirically exceeding 5 seconds per rejection in testing. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified; the fix shipped in 49.0.0 bounds path-building via a global signature-check budget.
PKCS#7 EnvelopedData decryption in the Python cryptography library (versions 44.0.0-49.x) leaks a Bleichenbacher oracle through four distinguishable error messages and timing side-channels during RSA PKCS#1 v1.5 key unwrapping, exposing the exact recovered plaintext length in one case. An attacker who can submit crafted EnvelopedData to an auto-decrypting service - such as an S/MIME gateway or mail filter that reflects outcomes at high volume - can adaptively recover the content-encryption key and decrypt intercepted messages. No public exploit has been identified at time of analysis, and exploitation requires very specific deployment conditions; the fix in version 50.0.0 applies RFC 3218 indistinguishability by substituting a random key on any failure.
Wildcard DNS SAN matching in python-cryptography's X.509 chain verifier prior to 49.0.0 allows a leaf certificate bearing *.example.com to satisfy a constrained intermediate CA's permittedSubtrees restriction of foo.example.com, enabling scope escape to sibling domains such as bar.example.com. Applications relying on the PolicyBuilder/Store verification API are exposed to acceptance of invalid certificate chains that should be rejected per RFC 5280 §4.2.1.10. A public proof-of-concept is confirmed in the GHSA advisory; the vulnerability is not in the CISA KEV catalog, but the CVSS 4.0 E:P modifier reflects the POC's availability.
Certificate path building in python-cryptography before 49.0.0 is exploitable as a denial-of-service vector by attackers who can supply crafted X.509 chains containing duplicate self-signed intermediate certificates. The Rust-based `build_chain_inner` function explores issuer candidates recursively without deduplicating previously analyzed entries, causing computational work to grow exponentially with the number of duplicates present - empirically exceeding 5 seconds per rejection in testing. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified; the fix shipped in 49.0.0 bounds path-building via a global signature-check budget.
PKCS#7 EnvelopedData decryption in the Python cryptography library (versions 44.0.0-49.x) leaks a Bleichenbacher oracle through four distinguishable error messages and timing side-channels during RSA PKCS#1 v1.5 key unwrapping, exposing the exact recovered plaintext length in one case. An attacker who can submit crafted EnvelopedData to an auto-decrypting service - such as an S/MIME gateway or mail filter that reflects outcomes at high volume - can adaptively recover the content-encryption key and decrypt intercepted messages. No public exploit has been identified at time of analysis, and exploitation requires very specific deployment conditions; the fix in version 50.0.0 applies RFC 3218 indistinguishability by substituting a random key on any failure.
Wildcard DNS SAN matching in python-cryptography's X.509 chain verifier prior to 49.0.0 allows a leaf certificate bearing *.example.com to satisfy a constrained intermediate CA's permittedSubtrees restriction of foo.example.com, enabling scope escape to sibling domains such as bar.example.com. Applications relying on the PolicyBuilder/Store verification API are exposed to acceptance of invalid certificate chains that should be rejected per RFC 5280 §4.2.1.10. A public proof-of-concept is confirmed in the GHSA advisory; the vulnerability is not in the CISA KEV catalog, but the CVSS 4.0 E:P modifier reflects the POC's availability.