Filtered by vendor Cryptography.io
Subscriptions
Filtered by product Cryptography
Subscriptions
Total
7 CVE
CVE | Vendors | Products | Updated | CVSS v3.1 |
---|---|---|---|---|
CVE-2023-50782 | 3 Couchbase, Cryptography.io, Redhat | 7 Couchbase Server, Cryptography, Ansible Automation Platform and 4 more | 2024-09-27 | 7.5 High |
A flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data. | ||||
CVE-2020-25659 | 3 Cryptography.io, Oracle, Redhat | 5 Cryptography, Communications Cloud Native Core Network Function Cloud Native Environment, Enterprise Linux and 2 more | 2024-09-09 | 5.9 Medium |
python-cryptography 3.2 is vulnerable to Bleichenbacher timing attacks in the RSA decryption API, via timed processing of valid PKCS#1 v1.5 ciphertext. | ||||
CVE-2016-9243 | 3 Canonical, Cryptography.io, Fedoraproject | 3 Ubuntu Linux, Cryptography, Fedora | 2024-09-09 | 7.5 High |
HKDF in cryptography before 1.5.2 returns an empty byte-string if used with a length less than algorithm.digest_size. | ||||
CVE-2023-49083 | 2 Cryptography.io, Redhat | 4 Cryptography, Ansible Automation Platform, Enterprise Linux and 1 more | 2024-09-05 | 5.9 Medium |
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling `load_pem_pkcs7_certificates` or `load_der_pkcs7_certificates` could lead to a NULL-pointer dereference and segfault. Exploitation of this vulnerability poses a serious risk of Denial of Service (DoS) for any application attempting to deserialize a PKCS7 blob/certificate. The consequences extend to potential disruptions in system availability and stability. This vulnerability has been patched in version 41.0.6. | ||||
CVE-2023-38325 | 1 Cryptography.io | 1 Cryptography | 2024-09-05 | 7.5 High |
The cryptography package before 41.0.2 for Python mishandles SSH certificates that have critical options. | ||||
CVE-2020-36242 | 4 Cryptography.io, Fedoraproject, Oracle and 1 more | 6 Cryptography, Fedora, Communications Cloud Native Core Network Function Cloud Native Environment and 3 more | 2024-09-05 | 9.1 Critical |
In the cryptography package before 3.3.2 for Python, certain sequences of update calls to symmetrically encrypt multi-GB values could result in an integer overflow and buffer overflow, as demonstrated by the Fernet class. | ||||
CVE-2023-23931 | 2 Cryptography.io, Redhat | 5 Cryptography, Ansible Automation Platform, Enterprise Linux and 2 more | 2024-09-05 | 4.8 Medium |
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In affected versions `Cipher.update_into` would accept Python objects which implement the buffer protocol, but provide only immutable buffers. This would allow immutable objects (such as `bytes`) to be mutated, thus violating fundamental rules of Python and resulting in corrupted output. This now correctly raises an exception. This issue has been present since `update_into` was originally introduced in cryptography 1.8. |
Page 1 of 1.