python-cryptography - Debian Package Tracker

general

source: python-cryptography (main)
version: 46.0.5-2
maintainer: Debian Python Team (DMD)
uploaders: Jérémy Lal [DMD] – Andrey Rakhmatullin [DMD]
arch: all any
std-ver: 4.7.3
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 3.3.2-1
o-o-sec: 3.3.2-1+deb11u1
oldstable: 38.0.4-3+deb12u1
old-sec: 38.0.4-3~deb12u1
stable: 43.0.0-3+deb13u1
testing: 46.0.5-2
unstable: 46.0.5-2

versioned links

3.3.2-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.3.2-1+deb11u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
38.0.4-3~deb12u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
38.0.4-3+deb12u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
43.0.0-3+deb13u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
46.0.5-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

python-cryptography-doc
python3-cryptography (2 bugs: 0, 1, 1, 0)

action needed

1 new commit since last upload, is it time to release? normal

vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:

commit 5e08cbfb5086844cadfcc6923024676b5024b790
Author: Alexandre Detiste <alexandre.detiste@gmail.com>
Date:   Mon Mar 23 16:16:01 2026 +0100

    drop Python2 debian/pydist-overrides

Created: 2026-03-23 Last update: 2026-03-23 17:01

2 low-priority security issues in bookworm low

There are 2 open security issues in bookworm.

1 issue left for the package maintainer to handle:

CVE-2026-26007: (needs triaging) cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to 46.0.5, the public_key_from_numbers (or EllipticCurvePublicNumbers.public_key()), EllipticCurvePublicNumbers.public_key(), load_der_public_key() and load_pem_public_key() functions do not verify that the point belongs to the expected prime-order subgroup of the curve. This missing validation allows an attacker to provide a public key point P from a small-order subgroup. This can lead to security issues in various situations, such as the most commonly used signature verification (ECDSA) and shared key negotiation (ECDH). When the victim computes the shared secret as S = [victim_private_key]P via ECDH, this leaks information about victim_private_key mod (small_subgroup_order). For curves with cofactor > 1, this reveals the least significant bits of the private key. When these weak public keys are used in ECDSA , it's easy to forge signatures on the small subgroup. Only SECT curves are impacted by this. This vulnerability is fixed in 46.0.5.

You can find information about how to handle this issue in the security team's documentation.

1 ignored issue:

CVE-2023-50782: A flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data.

Created: 2023-11-29 Last update: 2026-03-21 00:00

debian/patches: 3 patches to forward upstream low

Among the 4 debian patches available in version 46.0.5-2 of the package, we noticed the following issues:

3 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2023-02-26 Last update: 2026-03-17 23:00

testing migrations

This package will soon be part of the auto-openssl transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.

news

[rss feed]

[2026-03-21] python-cryptography 46.0.5-2 MIGRATED to testing (Debian testing watch)
[2026-03-17] Accepted python-cryptography 46.0.5-2 (source) into unstable (Jelmer Vernooĳ) (signed by: Jelmer Vernooij)
[2026-03-07] Accepted python-cryptography 43.0.0-3+deb13u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Arnaud Rebillout)
[2026-02-22] python-cryptography 46.0.5-1 MIGRATED to testing (Debian testing watch)
[2026-02-14] Accepted python-cryptography 46.0.5-1 (source) into unstable (Andrey Rakhmatullin) (signed by: Andrey Rahmatullin)
[2025-12-17] python-cryptography 46.0.1-1 MIGRATED to testing (Debian testing watch)
[2025-11-21] Accepted python-cryptography 46.0.1-1 (source) into unstable (Andrey Rakhmatullin) (signed by: Andrey Rahmatullin)
[2025-11-19] python-cryptography 45.0.7-1 MIGRATED to testing (Debian testing watch)
[2025-11-13] Accepted python-cryptography 46.0.1-1~exp1 (source) into experimental (Andrey Rakhmatullin) (signed by: Andrey Rahmatullin)
[2025-11-13] Accepted python-cryptography 45.0.7-1 (source) into unstable (Andrey Rakhmatullin) (signed by: Andrey Rahmatullin)
[2025-11-13] python-cryptography 45.0.6-1 MIGRATED to testing (Debian testing watch)
[2025-11-02] Accepted python-cryptography 45.0.6-1 (source) into unstable (Andrey Rakhmatullin) (signed by: Andrey Rahmatullin)
[2025-10-29] Accepted python-cryptography 45.0.6-1~exp1 (source) into experimental (Andrey Rakhmatullin) (signed by: Andrey Rahmatullin)
[2025-10-20] python-cryptography 44.0.2-2 MIGRATED to testing (Debian testing watch)
[2025-10-13] Accepted python-cryptography 44.0.2-2 (source) into unstable (Colin Watson)
[2025-10-02] python-cryptography 44.0.2-1 MIGRATED to testing (Debian testing watch)
[2025-09-19] Accepted python-cryptography 44.0.2-1 (source) into unstable (Andrey Rakhmatullin) (signed by: Andrey Rahmatullin)
[2025-05-05] python-cryptography 43.0.0-3 MIGRATED to testing (Debian testing watch)
[2025-04-25] Accepted python-cryptography 43.0.0-3 (source) into unstable (Andrey Rakhmatullin) (signed by: Andrey Rahmatullin)
[2025-04-04] python-cryptography 43.0.0-2 MIGRATED to testing (Debian testing watch)
[2025-03-28] Accepted python-cryptography 43.0.0-2 (source) into unstable (Andrey Rakhmatullin) (signed by: Andrey Rahmatullin)
[2024-10-19] Accepted python-cryptography 38.0.4-3+deb12u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Adrian Bunk)
[2024-10-16] Accepted python-cryptography 3.3.2-1+deb11u1 (source) into oldstable-security (Adrian Bunk)
[2024-09-25] python-cryptography 43.0.0-1 MIGRATED to testing (Debian testing watch)
[2024-09-10] Accepted python-cryptography 43.0.0-1 (source) into unstable (Andrey Rakhmatullin) (signed by: Andrey Rahmatullin)
[2024-05-05] python-cryptography 42.0.5-2 MIGRATED to testing (Debian testing watch)
[2024-03-19] Accepted python-cryptography 42.0.5-2 (source) into unstable (Jérémy Lal)
[2024-03-19] Accepted python-cryptography 42.0.5-1 (source) into unstable (Jérémy Lal)
[2024-03-07] Accepted python-cryptography 41.0.7-5 (source) into unstable (Jérémy Lal)
[2024-03-02] python-cryptography 41.0.7-4 MIGRATED to testing (Debian testing watch)

bugs [bug history graph]

all: 3
RC: 0
I&N: 1
M&W: 2
F&P: 0
patch: 0

links

homepage
lintian
buildd: logs, reproducibility, cross
popcon
browse source code
edit tags
other distros
security tracker
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 46.0.5-1ubuntu1
2 bugs
patches for 46.0.5-1ubuntu1