id: PYSEC-2023-112
modified: 2023-08-21T15:28:13.372385Z
published: 2023-07-14T20:15:00Z
aliases:
- CVE-2023-38325
- GHSA-cf7p-gm2m-833m
details: The cryptography package before 41.0.2 for Python mishandles SSH certificates
  that have critical options.
affected:
- package:
    ecosystem: PyPI
    name: cryptography
    purl: pkg:pypi/cryptography
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: 40.0.0
    - fixed: 41.0.2
  versions:
  - 40.0.0
  - 40.0.1
  - 40.0.2
  - 41.0.0
  - 41.0.1
references:
- type: PACKAGE
  url: https://pypi.org/project/cryptography/#history
- type: WEB
  url: https://github.com/pyca/cryptography/compare/41.0.1...41.0.2
- type: REPORT
  url: https://github.com/pyca/cryptography/issues/9207
- type: WEB
  url: https://github.com/pyca/cryptography/pull/9208
- type: ADVISORY
  url: https://github.com/advisories/GHSA-cf7p-gm2m-833m