Home / mailings

PDF

[USN-8776-1] python-cryptography vulnerabilities

Posted on 16 September 2026
Ubuntu Security

==========================================================================Ubuntu Security Notice USN-8776-1
September 16, 2026

python-cryptography vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 26.04 LTS
- Ubuntu 18.04 LTS

Summary:

Several security issues were fixed in python-cryptography.

Software Description:
- python-cryptography: Cryptography Python library

Details:

It was discovered that python-cryptography incorrectly accepted objects
with immutable buffers when performing certain cipher operations. This
would result in corrupted output, contrary to expectations. This issue only
affected Ubuntu 18.04 LTS. (CVE-2023-23931)

It was discovered that python-cryptography reported the outcome of
decrypting PKCS#7 enveloped data in distinguishable ways, and with
observable timing differences. A remote attacker could possibly use this
issue to recover the key used to encrypt the message contents, and obtain
sensitive information. This issue only affected Ubuntu 26.04 LTS.
(CVE-2026-69247)

Jack Lloyd discovered that python-cryptography incorrectly handled wildcard
DNS names when enforcing the name constraints of a certificate authority. A
remote attacker could possibly use this issue to have an invalid
certificate chain accepted, and use names outside of the permitted ones.
This issue only affected Ubuntu 26.04 LTS. (CVE-2026-69248)

Samuel Judson discovered that python-cryptography incorrectly handled
certificate chains that contained duplicate certificates. A remote attacker
could possibly use this issue to cause python-cryptography to use excessive
resources, leading to a denial of service. This issue only affected Ubuntu
26.04 LTS. (CVE-2026-69249)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 26.04 LTS
python-cryptography-doc 46.0.5-1ubuntu2.2
python3-cryptography 46.0.5-1ubuntu2.2

Ubuntu 18.04 LTS
python-cryptography 2.1.4-1ubuntu1.4+esm6
Available with Ubuntu Pro
python-cryptography-doc 2.1.4-1ubuntu1.4+esm6
Available with Ubuntu Pro
python3-cryptography 2.1.4-1ubuntu1.4+esm6
Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-8776-1
CVE-2023-23931, CVE-2026-69247, CVE-2026-69248, CVE-2026-69249

Package Information:
https://launchpad.net/ubuntu/+source/python-cryptography/46.0.5-1ubuntu2.2

--===============4920833045089132147==Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature

 

TOP