GitHub Advisoryadvisory · PyPI
GHSA-79v4-65xg-pq4g Vulnerable OpenSSL included in cryptography wheels
LOW
Official page ↗
- Aliases
- CVE-2024-12797
- Ecosystem
- PyPI
- Packages
- cryptography
- Severity
- Low
- Weaknesses
- CWE-1395, CWE-392
- Reviewed
- 2025-02-11
Affected packages
• PyPI cryptography: >= 42.0.0, < 44.0.1 → fixed in 44.0.1
Description
pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in cryptography 42.0.0-44.0.0 are vulnerable to a security issue. More details about the vulnerability itself can be found in https://openssl-library.org/news/secadv/20250211.txt.
If you are building cryptography source ("sdist") then you are responsible for upgrading your copy of OpenSSL. Only users installing from wheels built by the cryptography project (i.e., those distributed on PyPI) need to update their cryptography versions.
Related
Alias · CVE (1)
- CVE-2024-12797 Issue summary: Clients using RFC7250 Raw Public Keys (RPKs) to authenticate a server may fail to notice that the server was not… vulnerability
References
- https://github.com/pyca/cryptography/security/advisories/GHSA-79v4-65xg-pq4g web
- https://nvd.nist.gov/vuln/detail/CVE-2024-12797 advisory
- https://github.com/openssl/openssl/commit/738d4f9fdeaad57660dcba50a619fafced3fd5e9 web
- https://github.com/openssl/openssl/commit/798779d43494549b611233f92652f0da5328fbe7 web
- https://github.com/openssl/openssl/commit/87ebd203feffcf92ad5889df92f90bb0ee10a699 web
- https://github.com/pyca/cryptography package
- https://openssl-library.org/news/secadv/20250211.txt web
- http://www.openwall.com/lists/oss-security/2025/02/11/3 web
- http://www.openwall.com/lists/oss-security/2025/02/11/4 web