CVE-2023-38325: High severity IBM Cognos Analytics vulnerability
Python Cryptographic Authority cryptography could provide weaker than expected security, caused by an encoding mismatch regarding critical options with OpenSSH. An attacker could exploit this vulnerability to launch further attacks on the system
Other sources
The cryptography package before 41.0.2 for Python mishandles SSH certificates that have critical options.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/cryptographyto a version that resolves this vulnerability.Fixed in 41.0.2
Event History
Frequently Asked Questions
What is the vulnerability ID for the cryptography package?
The vulnerability ID for the cryptography package is CVE-2023-38325.
What is the severity level of CVE-2023-38325?
CVE-2023-38325 has a severity level of high, with a value of 7.5.
What does the cryptography package before version 41.0.2 for Python mishandle?
The cryptography package before version 41.0.2 for Python mishandles SSH certificates that have critical options.
Which software versions are affected by CVE-2023-38325?
The software versions affected by CVE-2023-38325 are cryptography package versions between 40.0.0 (inclusive) and 41.0.2 (exclusive).
How can I fix the vulnerability in the cryptography package?
To fix the vulnerability in the cryptography package, update to version 41.0.2 or later.