mrodden
commented
1 year ago I am not going to require a specific version of cryptography because of several reasons:
- cryptography is most often provided by the system libraries and I don't control that version
- there are many users that use a downlevel cryptography due to its Rust dependency in later versions
- this is not a really a security issue if you read the CVE description
Use cryptography which is free from CVE-2023-23931. See https://www.mend.io/vulnerability-database/CVE-2023-23931.