chore(deps): update dependency cryptography to v42.0.2 [security]
Metadata
Current evaluation
Merged automated update upgrading cryptography from 42.0.1 to 42.0.2 to patch CVE-2024-0727, preventing OpenSSL crashes from malformed PKCS12 files. Approved by two reviewers, passed CI, and merged automatically.
Suggested action: —
No scores available.
Issue body
[](https://renovatebot.com)
This PR contains the following updates:
| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [cryptography](https://togithub.com/pyca/cryptography) ([changelog](https://cryptography.io/en/latest/changelog/)) | `==42.0.1` -> `==42.0.2` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) |
### GitHub Vulnerability Alerts
#### [CVE-2024-0727](https://nvd.nist.gov/vuln/detail/CVE-2024-0727)
Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL
to crash leading to a potential Denial of Service attack
Impact summary: Applications loading files in the PKCS12 format from untrusted
sources might terminate abruptly.
A file in PKCS12 format can contain certificates and keys and may come from an
untrusted source. The PKCS12 specification allows certain fields to be NULL, but
OpenSSL does not correctly check for this case. This can lead to a NULL pointer
dereference that results in OpenSSL crashing. If an application processes PKCS12
files from an untrusted source using the OpenSSL APIs then that application will
be vulnerable to this issue.
OpenSSL APIs that are vulnerable to this are: PKCS12_parse(),
PKCS12_unpack_p7data(), PKCS12_unpack_p7encdata(), PKCS12_unpack_authsafes()
and PKCS12_newpass().
We have also fixed a similar issue in SMIME_write_PKCS7(). However since this
function is related to writing data we do not consider it security significant.
The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue.
---
### Release Notes
<details>
<summary>pyca/cryptography (cryptography)</summary>
### [`v42.0.2`](https://togithub.com/pyca/cryptography/compare/42.0.1...42.0.2)
[Compare Source](https://togithub.com/pyca/cryptography/compare/42.0.1...42.0.2)
</details>
---
### Configuration
📅 **Schedule**: Branch creation - "" in timezone Etc/UTC, Automerge - At any time (no schedule defined).
🚦 **Automerge**: Enabled.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/canonical/charmcraft).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy4xNzMuMCIsInVwZGF0ZWRJblZlciI6IjM3LjE3My4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiJ9-->
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen/qwen3.6-35b-a3b | — | — | Merged automated update upgrading cryptography from 42.0.1 to 42.0.2 to patch CVE-2024-0727, preventing OpenSSL crashes from malformed PKCS12 files. Approved by two reviewers, passed CI, and merged automatically. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged automated dependency update upgrading cryptography from 42.0.1 to 42.0.2 to patch CVE-2024-0727, a PKCS12 parsing denial-of-service vulnerability. Renovate bot handled the update and automerge. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged automated dependency update upgrading cryptography from v42.0.1 to v42.0.2 to patch CVE-2024-0727, a denial-of-service vulnerability in PKCS12 processing. Applied via Renovate bot and successfully merged. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #4598 chore(deps): update dependency cryptography to v42.0.4 [security] | snapcraft | merged | Merged automated dependency update upgrading cryptography from v42.0.2 to v42.0.4. This resolves CVE-2024-26130, fixing a NULL pointer dereference crash during pkcs12 serialization. Approved, passed CI, and merged successfully. | |
| #4564 chore(deps): update dependency cryptography to v42 [security] | snapcraft | merged | Merged automated dependency update upgrading cryptography from v41.0.7 to v42.0.2 to patch CVE-2023-50782 and CVE-2024-0727. The change passed CI checks, received two approvals, and was merged into main. | |
| #1201 chore(deps): update dependency cryptography to v41.0.3 [security] | charmcraft | merged | Merged automated update upgrading cryptography from v41.0.2 to v41.0.3 to resolve OpenSSL vulnerabilities in prebuilt wheels. Approved, passed CI, and auto-merged. | |
| #1396 chore(deps): update dependency cryptography to v41.0.6 [security] | charmcraft | merged | Merged automated dependency update upgrading cryptography from 41.0.4 to 41.0.6 to resolve CVE-2023-49083, preventing a denial of service from NULL-pointer dereference during PKCS7 parsing. Approved and merged automatically by Renovate. | |
| #1164 chore(deps): update dependency cryptography to v41.0.2 [security] | charmcraft | merged | Merged automated dependency update upgrading cryptography from v41.0.0 to v41.0.2 to resolve CVE-2023-38325 SSH certificate vulnerability. Approved, passed CI checks, and successfully merged via Renovate bot. | |
| #1019 chore(deps): update dependency cryptography to v39 [security] | charmcraft | closed | Superseded by PR #1024. The automated cryptography v39 security update was closed unmerged to prevent duplication with a newer dependency upgrade. | |
| #1120 chore(deps): update dependency cryptography to v41 [security] - autoclosed | charmcraft | closed | The cryptography v41 security update pull request was autoclosed without merging. Renovate automatically closed it due to inactivity or because the dependency was already updated. No reviews or CI checks were performed. | |
| #1537 chore(deps): update dependency cryptography to v42.0.4 [security] | charmcraft | closed | Maintainer closed the cryptography v42.0.4 security update without merging. The patch requires an environment variable change and will be handled separately. Renovate will ignore this specific version. | |
| #5010 build(deps): update dependency cryptography to v43.0.1 [security] (main) | snapcraft | merged | Merged an automated dependency update upgrading cryptography from 43.0.0 to 43.0.1 to patch a security vulnerability in statically linked OpenSSL wheels. Approved by two reviewers, passed CI, and merged to main. | |
| #1870 build(deps): update dependency cryptography to v43.0.1 [security] (main) | charmcraft | merged | Merged automated dependency update to cryptography v43.0.1 to address a security vulnerability in OpenSSL wheels. Approved by two reviewers, passed CI checks, and merged to main. |