---
id: CVE-2023-38325
aliases:
  - GHSA-cf7p-gm2m-833m
  - PYSEC-2023-112
title: cryptography mishandles SSH certificates
summary: cryptography mishandles SSH certificates
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'
vendor: cryptography
product: cryptography
ecosystem: pip
affected:
  - 'cryptography >= 40.0.0, < 41.0.2'
patched:
  - cryptography 41.0.2
published: '2023-07-14'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:49:57.356196452Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-cf7p-gm2m-833m'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2023-38325'
  - url: 'https://github.com/pyca/cryptography/issues/9207'
  - url: 'https://github.com/pyca/cryptography/pull/7960'
  - url: 'https://github.com/pyca/cryptography/pull/9208'
  - url: >-
      https://github.com/pyca/cryptography/commit/1ca7adc97b76a9dfbd3d850628b613eb93b78fc3
  - url: 'https://github.com/pyca/cryptography'
  - url: 'https://github.com/pyca/cryptography/compare/41.0.1...41.0.2'
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/cryptography/PYSEC-2023-112.yaml
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NMCCTYY3CSNQBFFYYC5DAV6KATHWCUZK
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NMCCTYY3CSNQBFFYYC5DAV6KATHWCUZK
  - url: 'https://pypi.org/project/cryptography/#history'
  - url: 'https://security.netapp.com/advisory/ntap-20230824-0010'
tags:
  - osv
  - pip
epss: 0.00732
epssPercentile: 0.52311
ingestedAt: '2026-09-12T03:13:01.687Z'
---

## Overview

The cryptography package before 41.0.2 for Python mishandles SSH certificates that have critical options.

## Affected packages

- `cryptography >= 40.0.0, < 41.0.2`

## Remediation

Upgrade to a patched release:

- `cryptography 41.0.2`