-------- Forwarded Message --------
Subject: [Python-announce] PyCA cryptography 46.0.7 released
Date: Tue, 7 Apr 2026 21:10:55 -0500
From: Paul Kehrer via Python-announce-list <[email protected]>
Reply-To: [email protected]
To: [email protected], [email protected]
CC: Paul Kehrer <[email protected]>
PyCA cryptography 46.0.7 has been released to PyPI. cryptography includes
both high level recipes and low level interfaces to common
cryptographic algorithms
such as symmetric ciphers, asymmetric algorithms, message digests, X.509,
key derivation functions, and much more. We support Python 3.8+, and PyPy3
3.11.
Changelog (https://cryptography.io/en/latest/changelog/#v46-0-7)
* **SECURITY ISSUE**: Fixed an issue where non-contiguous buffers could be
passed to APIs that accept Python buffers, which could lead to buffer
overflow. **CVE-2026-39892**
* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL
3.5.6.
-Paul Kehrer (reaperhulk)
_______________________________________________
Python-announce-list mailing list -- [email protected]
To unsubscribe send an email to [email protected]
https://mail.python.org/mailman3//lists/python-announce-list.python.org
https://github.com/pyca/cryptography/security/advisories/GHSA-p423-j2cm-9vmq
provides the additional info:
Package: cryptography (pip)
Affected versions: >= 45.0.0, < 46.0.7
Patched versions: 46.0.7
Description:
If a non-contiguous buffer was passed to APIs which accepted Python buffers
(e.g. Hash.update()), this could lead to buffer overflows. For example:
h = Hash(SHA256())
b.update(buf[::-1])
would read past the end of the buffer on Python >3.11
