Register | Log in

python-cryptography

Choose email to subscribe with

general

source: python-cryptography (main)
version: 49.0.0-2
maintainer: Debian Python Team (DMD)
uploaders: Jérémy Lal [DMD] – Andrey Rakhmatullin [DMD]
arch: all any
std-ver: 4.7.4
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 3.3.2-1
o-o-sec: 3.3.2-1+deb11u1
oldstable: 38.0.4-3+deb12u1
old-sec: 38.0.4-3~deb12u1
stable: 43.0.0-3+deb13u1
testing: 49.0.0-2
unstable: 49.0.0-2

versioned links

3.3.2-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.3.2-1+deb11u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
38.0.4-3~deb12u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
38.0.4-3+deb12u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
43.0.0-3+deb13u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
49.0.0-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

python-cryptography-doc
python3-cryptography (2 bugs: 0, 1, 1, 0)

action needed

5 security issues in bookworm high

There are 5 open security issues in bookworm.

2 important issues:

CVE-2026-69248:
CVE-2026-69249:

2 issues postponed or untriaged:

CVE-2026-26007: (needs triaging)
CVE-2026-34073: (needs triaging)

1 ignored issue:

CVE-2023-50782:

Created: 2026-08-04 Last update: 2026-09-01 18:30

A new upstream version is available: 50.0.1 high

A new upstream version 50.0.1 is available, you should consider packaging it.

Created: 2026-08-05 Last update: 2026-09-01 16:33

5 security issues in bullseye high

There are 5 open security issues in bullseye.

2 important issues:

CVE-2026-69248: cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to 49.0.0, if an intermediate constrained CA permits the DNS name foo.example.com, and the leaf certificate has a wildcard in its DNS SAN of *.example.com, python-cryptography's verifier accepts which allows escaping outside of the permitted names. The core issue is in DNSConstraint::matches, where a wildcard pattern was treated as matching a more-specific permitted constraint even though *.example.com can expand to sibling names such as bar.example.com outside foo.example.com. This allows acceptance of an invalid certificate chain. This issue is fixed in 49.0.0.
CVE-2026-69249: python-cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to 49.0.0, when resolving invalid certificate chains that include duplicate copies of self-signed certificates, the processing recursively invokes the same candidate, leading to an exponential blowup. Although the limitation that the chain depth cannot exceed a specified maximum depth prevents unbounded recursion and guarantees termination, an attacker-controlled certificate chain can lead the processing to easily take more than 5s to reject in testing. This amplification could form the basis for a resource exhaustion denial of service attack. The core issue arises in the recursive nature of build_chain_inner, which does not de-duplicate against previously analyzed candidates. As the correctness of validation is not affected, the integrity of a system cannot be compromised through this vector, only its availability. This issue is fixed in 49.0.0.

2 issues postponed or untriaged:

CVE-2026-26007: (postponed; to be fixed through a stable update) cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to 46.0.5, the public_key_from_numbers (or EllipticCurvePublicNumbers.public_key()), EllipticCurvePublicNumbers.public_key(), load_der_public_key() and load_pem_public_key() functions do not verify that the point belongs to the expected prime-order subgroup of the curve. This missing validation allows an attacker to provide a public key point P from a small-order subgroup. This can lead to security issues in various situations, such as the most commonly used signature verification (ECDSA) and shared key negotiation (ECDH). When the victim computes the shared secret as S = [victim_private_key]P via ECDH, this leaks information about victim_private_key mod (small_subgroup_order). For curves with cofactor > 1, this reveals the least significant bits of the private key. When these weak public keys are used in ECDSA , it's easy to forge signatures on the small subgroup. Only SECT curves are impacted by this. This vulnerability is fixed in 46.0.5.
CVE-2026-34073: (postponed; to be fixed through a stable update) cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to version 46.0.6, DNS name constraints were only validated against SANs within child certificates, and not the "peer name" presented during each validation. Consequently, cryptography would allow a peer named bar.example.com to validate against a wildcard leaf certificate for *.example.com, even if the leaf's parent certificate (or upwards) contained an excluded subtree constraint for bar.example.com. This issue has been patched in version 46.0.6.

1 ignored issue:

CVE-2023-50782: A flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data.

Created: 2026-08-04 Last update: 2026-08-22 01:00

3 low-priority security issues in trixie low

There are 3 open security issues in trixie.

3 issues left for the package maintainer to handle:

CVE-2026-34073: (needs triaging)
CVE-2026-69248: (needs triaging)
CVE-2026-69249: (needs triaging)

You can find information about how to handle these issues in the security team's documentation.

Created: 2026-03-31 Last update: 2026-09-01 18:30

debian/patches: 2 patches to forward upstream low

Among the 4 debian patches available in version 49.0.0-2 of the package, we noticed the following issues:

2 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2023-02-26 Last update: 2026-08-05 06:30

testing migrations

This package will soon be part of the auto-openssl transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.

news

[2026-08-22] python-cryptography 49.0.0-2 MIGRATED to testing (Debian testing watch)
[2026-08-04] Accepted python-cryptography 49.0.0-2 (source) into unstable (Andrey Rakhmatullin) (signed by: Andrey Rahmatullin)
[2026-07-15] Accepted python-cryptography 49.0.0-1 (source) into unstable (Andrey Rakhmatullin) (signed by: Andrey Rahmatullin)
[2026-07-15] python-cryptography 47.0.0-1 MIGRATED to testing (Debian testing watch)
[2026-06-23] Accepted python-cryptography 49.0.0-1~exp1 (source) into experimental (Andrey Rakhmatullin) (signed by: Andrey Rahmatullin)
[2026-06-23] Accepted python-cryptography 47.0.0-1 (source) into unstable (Andrey Rakhmatullin) (signed by: Andrey Rahmatullin)
[2026-04-24] python-cryptography 46.0.7-1 MIGRATED to testing (Debian testing watch)
[2026-04-09] Accepted python-cryptography 46.0.7-1 (source) into unstable (Andrey Rakhmatullin) (signed by: Andrey Rahmatullin)
[2026-04-07] python-cryptography 46.0.6-1 MIGRATED to testing (Debian testing watch)
[2026-03-27] Accepted python-cryptography 46.0.6-1 (source) into unstable (Andrey Rakhmatullin) (signed by: Andrey Rahmatullin)
[2026-03-21] python-cryptography 46.0.5-2 MIGRATED to testing (Debian testing watch)
[2026-03-17] Accepted python-cryptography 46.0.5-2 (source) into unstable (Jelmer Vernooĳ) (signed by: Jelmer Vernooij)
[2026-03-07] Accepted python-cryptography 43.0.0-3+deb13u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Arnaud Rebillout)
[2026-02-22] python-cryptography 46.0.5-1 MIGRATED to testing (Debian testing watch)
[2026-02-14] Accepted python-cryptography 46.0.5-1 (source) into unstable (Andrey Rakhmatullin) (signed by: Andrey Rahmatullin)
[2025-12-17] python-cryptography 46.0.1-1 MIGRATED to testing (Debian testing watch)
[2025-11-21] Accepted python-cryptography 46.0.1-1 (source) into unstable (Andrey Rakhmatullin) (signed by: Andrey Rahmatullin)
[2025-11-19] python-cryptography 45.0.7-1 MIGRATED to testing (Debian testing watch)
[2025-11-13] Accepted python-cryptography 46.0.1-1~exp1 (source) into experimental (Andrey Rakhmatullin) (signed by: Andrey Rahmatullin)
[2025-11-13] Accepted python-cryptography 45.0.7-1 (source) into unstable (Andrey Rakhmatullin) (signed by: Andrey Rahmatullin)
[2025-11-13] python-cryptography 45.0.6-1 MIGRATED to testing (Debian testing watch)
[2025-11-02] Accepted python-cryptography 45.0.6-1 (source) into unstable (Andrey Rakhmatullin) (signed by: Andrey Rahmatullin)
[2025-10-29] Accepted python-cryptography 45.0.6-1~exp1 (source) into experimental (Andrey Rakhmatullin) (signed by: Andrey Rahmatullin)
[2025-10-20] python-cryptography 44.0.2-2 MIGRATED to testing (Debian testing watch)
[2025-10-13] Accepted python-cryptography 44.0.2-2 (source) into unstable (Colin Watson)
[2025-10-02] python-cryptography 44.0.2-1 MIGRATED to testing (Debian testing watch)
[2025-09-19] Accepted python-cryptography 44.0.2-1 (source) into unstable (Andrey Rakhmatullin) (signed by: Andrey Rahmatullin)
[2025-05-05] python-cryptography 43.0.0-3 MIGRATED to testing (Debian testing watch)
[2025-04-25] Accepted python-cryptography 43.0.0-3 (source) into unstable (Andrey Rakhmatullin) (signed by: Andrey Rahmatullin)
[2025-04-04] python-cryptography 43.0.0-2 MIGRATED to testing (Debian testing watch)

1
2

bugs [bug history graph]

all: 3
RC: 0
I&N: 1
M&W: 2
F&P: 0
patch: 0

links

homepage
lintian
buildd: logs, reproducibility, cross
popcon
browse source code
other distros
security tracker
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 46.0.5-1ubuntu2
patches for 46.0.5-1ubuntu2

Debian Package Tracker — Copyright 2013-2025 The Distro Tracker Developers

Report problems to the tracker.debian.org pseudo-package in the Debian BTS.

Documentation — Bugs — Git Repository — Contributing