REDHAT-BUG-2456735: Buffer Overflow
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. This vulnerability is fixed in 46.0.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cryptographyto a version that resolves this vulnerability.Fixed in 46.0.7
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2456735?
The severity of REDHAT-BUG-2456735 is high with a score of 7.
How do I fix REDHAT-BUG-2456735?
To fix REDHAT-BUG-2456735, upgrade the cryptography package to version 46.0.7 or later.
What type of vulnerability is REDHAT-BUG-2456735?
REDHAT-BUG-2456735 is categorized as a Buffer Overflow vulnerability.
What can be affected by REDHAT-BUG-2456735?
REDHAT-BUG-2456735 can affect any application using the cryptography package that passes non-contiguous buffers to certain APIs.
When was REDHAT-BUG-2456735 published?
REDHAT-BUG-2456735 was published on April 8, 2026.