{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:c5dda5c1-b61d-5213-ba89-192b2d0dd152", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:pypi/cryptography@3.4.8.post1+tuxcare", "type": "library", "name": "cryptography", "version": "3.4.8.post1+tuxcare", "purl": "pkg:pypi/cryptography@3.4.8.post1+tuxcare" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:ffdae781-06c0-5b97-83fc-9d6849bbbc75", "id": "CVE-2023-0286", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-0286 affects version 3.4.8.post1+tuxcare of cryptography." }, "affects": [ { "ref": "pkg:pypi/cryptography@3.4.8.post1+tuxcare" } ] }, { "bom-ref": "urn:uuid:4a17e22c-d643-592f-b3fc-e6fbe47b215d", "id": "CVE-2023-23931", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-23931 is fixed in version 3.4.8.post1+tuxcare of cryptography." }, "affects": [ { "ref": "pkg:pypi/cryptography@3.4.8.post1+tuxcare" } ] }, { "bom-ref": "urn:uuid:ca80f372-2cd9-5561-b465-2fcbf95b29d9", "id": "CVE-2023-3446", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-3446 affects version 3.4.8.post1+tuxcare of cryptography." }, "affects": [ { "ref": "pkg:pypi/cryptography@3.4.8.post1+tuxcare" } ] }, { "bom-ref": "urn:uuid:a0d98f13-e2e8-59cc-8afc-54b6a6b18bca", "id": "CVE-2023-49083", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-49083 affects version 3.4.8.post1+tuxcare of cryptography." }, "affects": [ { "ref": "pkg:pypi/cryptography@3.4.8.post1+tuxcare" } ] }, { "bom-ref": "urn:uuid:2c336797-2f28-5a9b-9bf1-7a21f6746dd4", "id": "CVE-2023-50782", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-50782 is fixed in version 3.4.8.post1+tuxcare of cryptography." }, "affects": [ { "ref": "pkg:pypi/cryptography@3.4.8.post1+tuxcare" } ] }, { "bom-ref": "urn:uuid:51dee058-dbd9-5437-88b6-d9ac906bc3cc", "id": "CVE-2024-0727", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-0727 affects version 3.4.8.post1+tuxcare of cryptography." }, "affects": [ { "ref": "pkg:pypi/cryptography@3.4.8.post1+tuxcare" } ] }, { "bom-ref": "urn:uuid:2ad663fa-86af-5ede-8da6-a1907e3f8350", "id": "CVE-2024-12797", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-12797 affects version 3.4.8.post1+tuxcare of cryptography." }, "affects": [ { "ref": "pkg:pypi/cryptography@3.4.8.post1+tuxcare" } ] }, { "bom-ref": "urn:uuid:3b502d77-9d95-5d63-acc0-ae4fd4687d18", "id": "CVE-2026-26007", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-26007 affects version 3.4.8.post1+tuxcare of cryptography." }, "affects": [ { "ref": "pkg:pypi/cryptography@3.4.8.post1+tuxcare" } ] }, { "bom-ref": "urn:uuid:26e52cde-51da-539d-b267-b9f6e2f65ea8", "id": "CVE-2026-34073", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-34073 does not affect version 3.4.8.post1+tuxcare of cryptography. Not affected. CVE-2026-34073 (GHSA-m959-cc7f-wv43) is a defect in cryptography's own X.509 path validator: DNS name constraints were validated only against SANs in child certificates and not against the peer name presented at validation time. The upstream fix (pyca/cryptography 91d728897bdad30cd5c79a2b23e207f1f050d587, cherry-pick of #14542) changes production code only in src/rust/cryptography-x509-verification/{lib.rs,types.rs}, plus tests/x509/verification/test_limbo.py. That crate -- and its predecessor name cryptography-x509-validation -- first ships in tag 42.0.0. cryptography 3.4.8 does not contain it: src/rust holds only an empty _rust pymodule stub, there is no cryptography.x509.verification module, and no PolicyBuilder/Store/ClientVerifier/ServerVerifier/VerificationError. Verified empirically on the installed package -- 3.4.8 and 41.0.7: import of cryptography.x509.verification raises ModuleNotFoundError and none of the verifier symbols exist; 42.0.8: the module is present -- and on our shipped tree at tag tuxcare-release/3.4.8/3.4.8.post5+tuxcare, which likewise has no verification crate. NameConstraints in 3.4.8 is ASN.1 parse/encode of the extension only (x509/extensions.py, _decode/_encode_name_constraints); there is no chain building and no peer-name matching, so the vulnerable code path does not exist. 3.4.8 is flagged only because OSV declares the affected range as introduced:0 / fixed:46.0.6, which lists all 151 versions from 0.1 onwards rather than scoping it to 42.0.0+. Assessed and closed Won't Fix in PYELSCVE-644 on 2026-04-08. This VPV had been parked in patch_application_parent_pending behind leader VPV 46321 (cryptography 45.0.7), which has since released as 45.0.7.post3+tuxcare, so the follower never unblocked." }, "affects": [ { "ref": "pkg:pypi/cryptography@3.4.8.post1+tuxcare" } ] }, { "bom-ref": "urn:uuid:83e34e23-6552-58f2-82c9-9f4031d9caca", "id": "CVE-2026-69248", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-69248 does not affect version 3.4.8.post1+tuxcare of cryptography. not_affected \u2014 Version 3.4.8 is not affected by CVE-2026-69248. The vulnerability exists in python-cryptography's x509.verification module, which was introduced in version 42.0.0 (September 2023). Version 3.4.8, released in August 2021, predates this module by over two years and contains no certificate chain verification functionality. The CVE describes a bug in DNS wildcard name constraint matching within th..." }, "affects": [ { "ref": "pkg:pypi/cryptography@3.4.8.post1+tuxcare" } ] }, { "bom-ref": "urn:uuid:8b0bf36f-8ae7-5f8d-85dd-e5ad4be6466e", "id": "CVE-2026-69249", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-69249 does not affect version 3.4.8.post1+tuxcare of cryptography. not_affected \u2014 Version 3.4.8 does not contain the cryptography.x509.verification module or the cryptography-x509-verification Rust crate where the vulnerable build_chain_inner function resides. Certificate chain validation functionality was introduced 11 major versions later in version 42.0.0 (released 2024). Version 3.4.8 provides certificate parsing and building capabilities only, not chain validation. The ..." }, "affects": [ { "ref": "pkg:pypi/cryptography@3.4.8.post1+tuxcare" } ] }, { "bom-ref": "urn:uuid:7f184f16-5efa-5aff-9798-688bddf03300", "id": "GHSA-537c-gmf6-5ccf", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-537c-gmf6-5ccf does not affect version 3.4.8.post1+tuxcare of cryptography. not_affected \u2014 The CVE concerns vulnerable OpenSSL bundled in pre-built cryptography WHEELS (binary distributions), not the source code. The target repository (version 3.4.8.post5+tuxcare) contains only cryptography's source code and Python bindings to OpenSSL, but does NOT contain OpenSSL source code or binaries. The CVE explicitly states: 'If you are building cryptography source (sdist) then you are respons..." }, "affects": [ { "ref": "pkg:pypi/cryptography@3.4.8.post1+tuxcare" } ] }, { "bom-ref": "urn:uuid:8af2ced2-6c6d-5d69-82d2-26d306169c96", "id": "GHSA-5cpq-8wj7-hf2v", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-5cpq-8wj7-hf2v affects version 3.4.8.post1+tuxcare of cryptography." }, "affects": [ { "ref": "pkg:pypi/cryptography@3.4.8.post1+tuxcare" } ] }, { "bom-ref": "urn:uuid:f7320d22-9689-5987-aadc-eca1ba253bea", "id": "GHSA-jm77-qphf-c4w8", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-jm77-qphf-c4w8 affects version 3.4.8.post1+tuxcare of cryptography." }, "affects": [ { "ref": "pkg:pypi/cryptography@3.4.8.post1+tuxcare" } ] }, { "bom-ref": "urn:uuid:a24b89da-3111-52de-8e6c-e0f466587c13", "id": "GHSA-v8gr-m533-ghj9", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-v8gr-m533-ghj9 affects version 3.4.8.post1+tuxcare of cryptography." }, "affects": [ { "ref": "pkg:pypi/cryptography@3.4.8.post1+tuxcare" } ] } ], "dependencies": [ { "ref": "pkg:pypi/cryptography@3.4.8.post1+tuxcare" } ] }