[<prev] [next>] [day] [month] [year] [list]
Message-ID: <e5f6459d-f949-4473-8961-5d66ad9d3e50@oracle.com>
Date: Wed, 8 Apr 2026 12:49:50 -0700
From: Alan Coopersmith <alan.coopersmith@...cle.com>
To: oss-security@...ts.openwall.com
Subject: PyCA cryptography 46.0.7 released, fixes
CVE-2026-39892
-------- Forwarded Message --------
Subject: [Python-announce] PyCA cryptography 46.0.7 released
Date: Tue, 7 Apr 2026 21:10:55 -0500
From: Paul Kehrer via Python-announce-list <python-announce-list@...hon.org>
Reply-To: python-list@...hon.org
To: python-announce-list@...hon.org, cryptography-dev@...hon.org
CC: Paul Kehrer <paul.l.kehrer@...il.com>
PyCA cryptography 46.0.7 has been released to PyPI. cryptography includes
both high level recipes and low level interfaces to common
cryptographic algorithms
such as symmetric ciphers, asymmetric algorithms, message digests, X.509,
key derivation functions, and much more. We support Python 3.8+, and PyPy3
3.11.
Changelog (https://cryptography.io/en/latest/changelog/#v46-0-7)
* **SECURITY ISSUE**: Fixed an issue where non-contiguous buffers could be
passed to APIs that accept Python buffers, which could lead to buffer
overflow. **CVE-2026-39892**
* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL
3.5.6.
-Paul Kehrer (reaperhulk)
_______________________________________________
Python-announce-list mailing list -- python-announce-list@...hon.org
To unsubscribe send an email to python-announce-list-leave@...hon.org
https://mail.python.org/mailman3//lists/python-announce-list.python.org
https://github.com/pyca/cryptography/security/advisories/GHSA-p423-j2cm-9vmq
provides the additional info:
Package: cryptography (pip)
Affected versions: >= 45.0.0, < 46.0.7
Patched versions: 46.0.7
Description:
If a non-contiguous buffer was passed to APIs which accepted Python buffers
(e.g. Hash.update()), this could lead to buffer overflows. For example:
h = Hash(SHA256())
b.update(buf[::-1])
would read past the end of the buffer on Python >3.11
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
