CVE-2023-50782High· 7.5▾ TwilightPython Cryptography package vulnerable to Bleichenbacher timing oracle attack
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
1.1%
Last analysed / modified upstream
A flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data.
cryptography < 42.0.0Upgrade to a patched release:
cryptography 42.0.0Connected by shared product, vendor, weakness, or advisory.
CVE-2023-23931Medium· 6.5Cipher.update_into can corrupt memory if passed an immutable python object as the outbuf
GHSA-v8gr-m533-ghj9LowVulnerable OpenSSL included in cryptography wheels
CVE-2026-34073Medium· 5.3cryptography has incomplete DNS name constraint enforcement on peer names
GHSA-jm77-qphf-c4w8Lowpyca/cryptography's wheels include vulnerable OpenSSL
CVE-2023-49083Medium· 5.9cryptography vulnerable to NULL-dereference when loading PKCS7 certificates
GHSA-h4gh-qq45-vh27Mediumpyca/cryptography has a vulnerable OpenSSL included in cryptography wheels