Executive brief
The Python cryptography library includes a statically linked copy of OpenSSL in its pre-built distributions (wheels). Versions 37.0.0 through 38.0.3 bundled a vulnerable OpenSSL that is susceptible to multiple security issues, including a stack-based buffer overflow. Users who install cryptography from pre-built wheels on PyPI are affected; those building from source code must manually upgrade their OpenSSL dependencies.
Technical details
The cryptography library bundles OpenSSL statically within its wheel distributions for ease of deployment. Versions 37.0.0–38.0.2 of the wheels included OpenSSL 1.1.1q and earlier, which contain multiple documented vulnerabilities including CVE-2022-3602 (a stack-based buffer overflow in X.509 certificate parsing). The vulnerability is reachable over the network when the library processes untrusted certificates or cryptographic data. The patch, released in version 38.0.3, upgrades the bundled OpenSSL to a patched release. Users building cryptography from source distribution (sdist) are not directly affected but must manage their own OpenSSL updates.
Affected products
- pyca cryptography 37.0.0 through 38.0.2
Timeline
- 2022-11-02: disclosed
- 2022-11-02: patched