Quick answers
- Is This vulnerability exploited in the wild?
- No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
- How severe is This vulnerability?
- Informational severity, published 2 November 2022.
- Which products and versions are affected?
- cryptography (PyPI) ECOSYSTEM:introduced=37.0.0,fixed=38.0.3.
- Is there a fix for This vulnerability?
- Yes. cryptography (PyPI): upgrade to 38.0.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is This vulnerability attacked?
- It is attacked over the network, in a software library.
- Am I affected?
- Check whether you run cryptography (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- cryptography (PyPI): upgrade to 38.0.3 or later
pip install "cryptography>=38.0.3"
Technical details
The cryptography library bundles OpenSSL statically within its wheel distributions for ease of deployment. Versions 37.0.0–38.0.2 of the wheels included OpenSSL 1.1.1q and earlier, which contain multiple documented vulnerabilities including CVE-2022-3602 (a stack-based buffer overflow in X.509 certificate parsing). The vulnerability is reachable over the network when the library processes untrusted certificates or cryptographic data. The patch, released in version 38.0.3, upgrades the bundled OpenSSL to a patched release. Users building cryptography from source distribution (sdist) are not directly affected but must manage their own OpenSSL updates.
Affected products
- pyca cryptography 37.0.0 through 38.0.2
Timeline
- 2022-11-02: disclosed
- 2022-11-02: patched