chore(deps): update dependency cryptography to v42 [security]
Metadata
Current evaluation
Renovate bumped cryptography from 41.0.7 to 42.0.2 (fixing CVE-2023-50782 and CVE-2024-0727); PR #4564 was approved and squash-merged into main as commit ac421ab96.
Resolution: closed resolved
Reason: The PR was approved by two reviewers and squash-merged into main as commit ac421ab96 ("chore(deps): update dependency cryptography to v42 [security] (#4564)"), replacing the 41.0.7 pins with 42.0.2. A follow-up PR (#4598) later moved the pin to 42.0.4.
Evaluated by: mr-cal-bot
No scores available.
Issue body
[](https://renovatebot.com)
This PR contains the following updates:
| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [cryptography](https://togithub.com/pyca/cryptography) ([changelog](https://cryptography.io/en/latest/changelog/)) | `==41.0.7` -> `==42.0.2` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) |
### GitHub Vulnerability Alerts
#### [CVE-2023-50782](https://nvd.nist.gov/vuln/detail/CVE-2023-50782)
A flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data.
#### [CVE-2024-0727](https://nvd.nist.gov/vuln/detail/CVE-2024-0727)
Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL
to crash leading to a potential Denial of Service attack
Impact summary: Applications loading files in the PKCS12 format from untrusted
sources might terminate abruptly.
A file in PKCS12 format can contain certificates and keys and may come from an
untrusted source. The PKCS12 specification allows certain fields to be NULL, but
OpenSSL does not correctly check for this case. This can lead to a NULL pointer
dereference that results in OpenSSL crashing. If an application processes PKCS12
files from an untrusted source using the OpenSSL APIs then that application will
be vulnerable to this issue.
OpenSSL APIs that are vulnerable to this are: PKCS12_parse(),
PKCS12_unpack_p7data(), PKCS12_unpack_p7encdata(), PKCS12_unpack_authsafes()
and PKCS12_newpass().
We have also fixed a similar issue in SMIME_write_PKCS7(). However since this
function is related to writing data we do not consider it security significant.
The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue.
---
### Release Notes
<details>
<summary>pyca/cryptography (cryptography)</summary>
### [`v42.0.2`](https://togithub.com/pyca/cryptography/compare/42.0.1...42.0.2)
[Compare Source](https://togithub.com/pyca/cryptography/compare/42.0.1...42.0.2)
### [`v42.0.1`](https://togithub.com/pyca/cryptography/compare/42.0.0...42.0.1)
[Compare Source](https://togithub.com/pyca/cryptography/compare/42.0.0...42.0.1)
### [`v42.0.0`](https://togithub.com/pyca/cryptography/compare/41.0.7...42.0.0)
[Compare Source](https://togithub.com/pyca/cryptography/compare/41.0.7...42.0.0)
</details>
---
### Configuration
📅 **Schedule**: Branch creation - "" in timezone Etc/UTC, Automerge - "every weekend" in timezone Etc/UTC.
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/canonical/snapcraft).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy4xNzMuMCIsInVwZGF0ZWRJblZlciI6IjM3LjE3My4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiJ9-->
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Renovate bumped cryptography from 41.0.7 to 42.0.2 (fixing CVE-2023-50782 and CVE-2024-0727); PR #4564 was approved and squash-merged into main as commit ac421ab96. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged PR #4564 updated cryptography from 41.0.7 to 42.0.2, addressing CVE-2023-50782 and CVE-2024-0727. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged automated dependency update upgrading cryptography from v41.0.7 to v42.0.2 to patch CVE-2023-50782 and CVE-2024-0727. The change passed CI checks, received two approvals, and was merged into main. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged automated dependency update upgrading cryptography from 41.0.7 to 42.0.2 to address CVE-2023-50782 and CVE-2024-0727. Code coverage passed and the change was successfully integrated. |
Update history
No update history recorded yet.
Related work
-
Related To:
canonical/snapcraft#4598
(confidence 75%)
Follow-up Renovate PR that further bumped cryptography to 42.0.4 [security] (commit 7cfb60986) after #4564 landed.
-
Related To:
canonical/snapcraft#5010
(confidence 45%)
Later Renovate update bumping cryptography to 43.0.1 [security], continuing the same dependency line.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #4598 chore(deps): update dependency cryptography to v42.0.4 [security] | snapcraft | merged | Merged #4598 in commit 7cfb60986, upgrading cryptography from 42.0.2 to 42.0.4 to address CVE-2024-26130. | |
| #1529 chore(deps): update dependency cryptography to v42.0.2 [security] | charmcraft | merged | Renovate security bump of cryptography 42.0.1 -> 42.0.2 (CVE-2024-0727 PKCS12 DoS) merged to main as commit f80f2cd4, a 2-line requirements.txt pin change. | |
| #1537 chore(deps): update dependency cryptography to v42.0.4 [security] | charmcraft | closed | Renovate PR to bump cryptography 42.0.2->42.0.4 (CVE-2024-26130) was closed unmerged by lengau on 2024-02-22, deferred to a separate env-var change; the pin later moved to 42.0.5 via merged #1601 (545b8db5) and 42.0.8 in #1694. | |
| #1164 chore(deps): update dependency cryptography to v41.0.2 [security] | charmcraft | merged | Merged cryptography 41.0.2 security update via commit 6d9dd818, replacing 41.0.0 to address CVE-2023-38325. | |
| #1396 chore(deps): update dependency cryptography to v41.0.6 [security] | charmcraft | merged | Merged PR #1396 upgraded cryptography from 41.0.4 to 41.0.6 via commit d8a889db, fixing the PKCS#7 NULL-pointer denial-of-service vulnerability CVE-2023-49083. | |
| #1272 chore(deps): update dependency cryptography to v41.0.4 [security] | charmcraft | closed | Renovate security bump of cryptography 41.0.3 -> 41.0.4 was closed unmerged by @lengau on 2023-09-21 (flaky store test) in favour of #1271, which landed as commit 431c7387. | |
| #1120 chore(deps): update dependency cryptography to v41 [security] - autoclosed | charmcraft | closed | Autoclosed unmerged; the same cryptography 40.0.2→41.0.0 security update was merged via #1119 in commit 42365b41. | |
| #1201 chore(deps): update dependency cryptography to v41.0.3 [security] | charmcraft | merged | Merged as commit 31f7281c, updating cryptography from 41.0.2 to 41.0.3 to address vulnerable OpenSSL bundled in its wheels. | |
| #1056 chore(deps): update dependency cryptography to v39 [security] | charmcraft | closed | Renovate's cryptography 3.4.8->39.0.1 security bump was closed unmerged; maintainer lengau pointed to #1024, which merged as commit 96f6a183 upgrading to 39.0 (plus Rust build deps) and closing #991. | |
| #1057 chore(deps): update dependency cryptography [security] - autoclosed | charmcraft | closed | Renovate’s cryptography 3.4.8→39/40 update was autoclosed unmerged; PR #1119 (commit 42365b41) later merged 40.0.2→41.0.0, superseding it. |