chore(deps): update dependency cryptography to v42.0.4 [security]
Metadata
Current evaluation
Renovate PR to bump cryptography 42.0.2->42.0.4 (CVE-2024-26130) was closed unmerged by lengau on 2024-02-22, deferred to a separate env-var change; the pin later moved to 42.0.5 via merged #1601 (545b8db5) and 42.0.8 in #1694.
Resolution: closed superseded
Reason: Maintainer lengau closed it without merging, noting "This will get updated separately - the patch version requires an environment variable change." The cryptography pin was subsequently advanced by merged PR canonical/charmcraft#1601 (commit 545b8db5) to 42.0.5, which includes the 42.0.4 security fix, so the CVE was covered without this PR.
Evaluated by: mr-cal-bot
No scores available.
Issue body
[](https://renovatebot.com)
This PR contains the following updates:
| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [cryptography](https://togithub.com/pyca/cryptography) ([changelog](https://cryptography.io/en/latest/changelog/)) | `==42.0.2` -> `==42.0.4` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) |
### GitHub Vulnerability Alerts
#### [CVE-2024-26130](https://togithub.com/pyca/cryptography/security/advisories/GHSA-6vqw-3v5j-54x4)
If `pkcs12.serialize_key_and_certificates` is called with both:
1. A certificate whose public key did not match the provided private key
2. An `encryption_algorithm` with `hmac_hash` set (via `PrivateFormat.PKCS12.encryption_builder().hmac_hash(...)`
Then a NULL pointer dereference would occur, crashing the Python process.
This has been resolved, and now a `ValueError` is properly raised.
Patched in [https://github.com/pyca/cryptography/pull/10423](https://togithub.com/pyca/cryptography/pull/10423)
---
### Release Notes
<details>
<summary>pyca/cryptography (cryptography)</summary>
### [`v42.0.4`](https://togithub.com/pyca/cryptography/compare/42.0.3...42.0.4)
[Compare Source](https://togithub.com/pyca/cryptography/compare/42.0.3...42.0.4)
### [`v42.0.3`](https://togithub.com/pyca/cryptography/compare/42.0.2...42.0.3)
[Compare Source](https://togithub.com/pyca/cryptography/compare/42.0.2...42.0.3)
</details>
---
### Configuration
📅 **Schedule**: Branch creation - "" in timezone Etc/UTC, Automerge - At any time (no schedule defined).
🚦 **Automerge**: Enabled.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/canonical/charmcraft).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy4yMDAuMCIsInVwZGF0ZWRJblZlciI6IjM3LjIwMC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiJ9-->
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed superseded | Renovate PR to bump cryptography 42.0.2->42.0.4 (CVE-2024-26130) was closed unmerged by lengau on 2024-02-22, deferred to a separate env-var change; the pin later moved to 42.0.5 via merged #1601 (545b8db5) and 42.0.8 in #1694. | |
| stealth/space-bunny-alpha | — | closed superseded | Closed unmerged; the cryptography 42.0.4 patch was superseded by merged PR #1601 (545b8db5), which raised cryptography to 42.0.5. | |
| stealth/space-bunny-alpha | — | closed superseded | Renovate bump of cryptography 42.0.2 -> 42.0.4 (CVE-2024-26130) was closed unmerged by @lengau, who said it needed a separate environment variable change; the pin was later raised to 42.0.5 via merged PR #1601 (545b8db5). | |
| stealth/space-bunny-alpha | — | closed superseded | Closed unmerged; deferred for a separate environment-variable change. Later dependency PR #1601 merged (545b8db5), and #1694 (f46fb734) later raised cryptography to 42.0.8. | |
| qwen/qwen3.6-35b-a3b | — | — | Maintainer closed the cryptography v42.0.4 security update without merging. The patch requires an environment variable change and will be handled separately. Renovate will ignore this specific version. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Updating cryptography to v42.0.4 to address CVE-2024-26130 was closed without merging. A maintainer declined the automated update, stating the patch requires an environment variable change and will be applied separately. |
Update history
No update history recorded yet.
Related work
-
Superseded By:
canonical/charmcraft#1601
(confidence 88%)
Merged 'chore(deps): update bugfixes' as 545b8db5, bumping cryptography to 42.0.5, incorporating the 42.0.4 CVE-2024-26130 fix.
-
Related To:
canonical/charmcraft#1694
(confidence 80%)
Later merged dependency bump (f46fb734) raising cryptography to 42.0.8.
-
Related To:
canonical/charmcraft#1529
(confidence 60%)
Prior merged cryptography security update to 42.0.2 that this PR would have incremented.
-
Related To:
canonical/snapcraft#4598
(confidence 55%)
Same 42.0.2->42.0.4 security bump merged in the sibling snapcraft repo (7cfb60986).
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #4564 chore(deps): update dependency cryptography to v42 [security] | snapcraft | merged | Renovate bumped cryptography from 41.0.7 to 42.0.2 (fixing CVE-2023-50782 and CVE-2024-0727); PR #4564 was approved and squash-merged into main as commit ac421ab96. | |
| #4598 chore(deps): update dependency cryptography to v42.0.4 [security] | snapcraft | merged | Merged #4598 in commit 7cfb60986, upgrading cryptography from 42.0.2 to 42.0.4 to address CVE-2024-26130. | |
| #1529 chore(deps): update dependency cryptography to v42.0.2 [security] | charmcraft | merged | Renovate security bump of cryptography 42.0.1 -> 42.0.2 (CVE-2024-0727 PKCS12 DoS) merged to main as commit f80f2cd4, a 2-line requirements.txt pin change. | |
| #1272 chore(deps): update dependency cryptography to v41.0.4 [security] | charmcraft | closed | Renovate security bump of cryptography 41.0.3 -> 41.0.4 was closed unmerged by @lengau on 2023-09-21 (flaky store test) in favour of #1271, which landed as commit 431c7387. | |
| #1164 chore(deps): update dependency cryptography to v41.0.2 [security] | charmcraft | merged | Merged cryptography 41.0.2 security update via commit 6d9dd818, replacing 41.0.0 to address CVE-2023-38325. | |
| #1396 chore(deps): update dependency cryptography to v41.0.6 [security] | charmcraft | merged | Merged PR #1396 upgraded cryptography from 41.0.4 to 41.0.6 via commit d8a889db, fixing the PKCS#7 NULL-pointer denial-of-service vulnerability CVE-2023-49083. | |
| #1120 chore(deps): update dependency cryptography to v41 [security] - autoclosed | charmcraft | closed | Autoclosed unmerged; the same cryptography 40.0.2→41.0.0 security update was merged via #1119 in commit 42365b41. | |
| #978 chore(deps): update dependency cryptography to v39 | charmcraft | closed | Renovate PR to bump cryptography 3.4.8 -> 39.0.0 was closed unmerged by lengau (2023-01-19) because cryptography 39 needs Rust >=1.48 unavailable on 18.04/20.04 armhf/arm64/ppc64el/s390x. Later redone manually and merged as #1024 (96f6a183). | |
| #1056 chore(deps): update dependency cryptography to v39 [security] | charmcraft | closed | Renovate's cryptography 3.4.8->39.0.1 security bump was closed unmerged; maintainer lengau pointed to #1024, which merged as commit 96f6a183 upgrading to 39.0 (plus Rust build deps) and closing #991. | |
| #1057 chore(deps): update dependency cryptography [security] - autoclosed | charmcraft | closed | Renovate’s cryptography 3.4.8→39/40 update was autoclosed unmerged; PR #1119 (commit 42365b41) later merged 40.0.2→41.0.0, superseding it. |