python-cryptography vulnerabilities

The vulnerability in python-cryptography 3.2 allows Bleichenbacher timing attacks on the RSA decryption API. Attackers can exploit timing differences in processing valid PKCS#1 v1.5 ciphertext.

python-cryptography, a cryptographic library for Python, prior to version 49.0.0, is vulnerable to DoS via resource exhaustion. When resolving invalid certificate chains with duplicate self-signed certificates, processing recursively invokes the same candidate, leading to exponential blowup. An attacker can supply a chain causing processing time over 5 seconds, leading to denial of service. Fixed in version 49.0.0.

The python-cryptography library prior to version 49.0.0 incorrectly handles DNS constraints in certificates. If an intermediate CA restricts a name to foo.example.com and the leaf certificate contains a wildcard *.example.com, the validator accepts a certificate that escapes the permitted names, allowing acceptance of an invalid certificate chain.