search

latchset / jwcrypto

Implements JWK,JWS,JWE specifications using python-cryptography
GNU Lesser General Public License v3.0
432 stars 119 forks source link

Crytography Vulnerabilties #315

Closed jin-ahn closed 1 year ago

jin-ahn commented 1 year ago

latest 1.4.2 has vulnerabilities in cryptography due to openssl version utilized. Upgrading to openssl 3.0.7+ should resolve it. https://nvd.nist.gov/vuln/detail/CVE-2022-3602

image
simo5 commented 1 year ago

Cool but we give the minimum version of python-cryptography that will properly work for the ABI/API point of view and has the necessary features.

I am not in the business of policing what underlying OpenSSL was used.

Besides, binary distributions (like Fedora, RHEL, SuSe, Ubuntu, etc) tend to patch CVEs by backporting the fixes to previous OpenSSL versions, so a version check on OpenSSL would be detrimental, reducing the availability or forcing users to patch the code back to use their provider's OpenSSL version.