chore(deps): update dependency cryptography to v42.0.4 [security]
Metadata
Current evaluation
Merged #4598 in commit 7cfb60986, upgrading cryptography from 42.0.2 to 42.0.4 to address CVE-2024-26130.
Resolution: closed resolved
Reason: The approved dependency update was merged as commit 7cfb60986. cryptography 42.0.4 includes the upstream PKCS#12 NULL-dereference fix from pyca/cryptography#10423.
Evaluated by: mr-cal-bot
No scores available.
Issue body
[](https://renovatebot.com)
This PR contains the following updates:
| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [cryptography](https://togithub.com/pyca/cryptography) ([changelog](https://cryptography.io/en/latest/changelog/)) | `==42.0.2` -> `==42.0.4` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) |
### GitHub Vulnerability Alerts
#### [CVE-2024-26130](https://togithub.com/pyca/cryptography/security/advisories/GHSA-6vqw-3v5j-54x4)
If `pkcs12.serialize_key_and_certificates` is called with both:
1. A certificate whose public key did not match the provided private key
2. An `encryption_algorithm` with `hmac_hash` set (via `PrivateFormat.PKCS12.encryption_builder().hmac_hash(...)`
Then a NULL pointer dereference would occur, crashing the Python process.
This has been resolved, and now a `ValueError` is properly raised.
Patched in [https://github.com/pyca/cryptography/pull/10423](https://togithub.com/pyca/cryptography/pull/10423)
---
### Release Notes
<details>
<summary>pyca/cryptography (cryptography)</summary>
### [`v42.0.4`](https://togithub.com/pyca/cryptography/compare/42.0.3...42.0.4)
[Compare Source](https://togithub.com/pyca/cryptography/compare/42.0.3...42.0.4)
### [`v42.0.3`](https://togithub.com/pyca/cryptography/compare/42.0.2...42.0.3)
[Compare Source](https://togithub.com/pyca/cryptography/compare/42.0.2...42.0.3)
</details>
---
### Configuration
📅 **Schedule**: Branch creation - "" in timezone Etc/UTC, Automerge - "every weekend" in timezone Etc/UTC.
🚦 **Automerge**: Enabled.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/canonical/snapcraft).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy4yMDAuMCIsInVwZGF0ZWRJblZlciI6IjM3LjIwMC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiJ9-->
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Merged #4598 in commit 7cfb60986, upgrading cryptography from 42.0.2 to 42.0.4 to address CVE-2024-26130. | |
| stealth/space-bunny-alpha | — | closed resolved | Renovate PR merged as commit 7cfb60986, bumping cryptography from 42.0.2 to 42.0.4 (2 files, +2/-2) to fix CVE-2024-26130 PKCS#12 NULL pointer crash. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged #4598 as 7cfb60986, upgrading cryptography from 42.0.2 to 42.0.4 to remediate CVE-2024-26130, a PKCS#12 NULL-pointer crash. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged automated dependency update upgrading cryptography from v42.0.2 to v42.0.4. This resolves CVE-2024-26130, fixing a NULL pointer dereference crash during pkcs12 serialization. Approved, passed CI, and merged successfully. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged automated dependency update upgrading cryptography from v42.0.2 to v42.0.4 to patch CVE-2024-26130. Renovate bot handled the change, tests passed via Codecov, and the update was auto-merged. |
Update history
No update history recorded yet.
Related work
-
Likely Fixed By:
cryptography#10423
(confidence 100%)
Upstream cryptography fix for CVE-2024-26130 included in the merged 42.0.4 update.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #4564 chore(deps): update dependency cryptography to v42 [security] | snapcraft | merged | Renovate bumped cryptography from 41.0.7 to 42.0.2 (fixing CVE-2023-50782 and CVE-2024-0727); PR #4564 was approved and squash-merged into main as commit ac421ab96. | |
| #1164 chore(deps): update dependency cryptography to v41.0.2 [security] | charmcraft | merged | Merged cryptography 41.0.2 security update via commit 6d9dd818, replacing 41.0.0 to address CVE-2023-38325. | |
| #1529 chore(deps): update dependency cryptography to v42.0.2 [security] | charmcraft | merged | Renovate security bump of cryptography 42.0.1 -> 42.0.2 (CVE-2024-0727 PKCS12 DoS) merged to main as commit f80f2cd4, a 2-line requirements.txt pin change. | |
| #1537 chore(deps): update dependency cryptography to v42.0.4 [security] | charmcraft | closed | Renovate PR to bump cryptography 42.0.2->42.0.4 (CVE-2024-26130) was closed unmerged by lengau on 2024-02-22, deferred to a separate env-var change; the pin later moved to 42.0.5 via merged #1601 (545b8db5) and 42.0.8 in #1694. | |
| #1396 chore(deps): update dependency cryptography to v41.0.6 [security] | charmcraft | merged | Merged PR #1396 upgraded cryptography from 41.0.4 to 41.0.6 via commit d8a889db, fixing the PKCS#7 NULL-pointer denial-of-service vulnerability CVE-2023-49083. | |
| #1201 chore(deps): update dependency cryptography to v41.0.3 [security] | charmcraft | merged | Merged as commit 31f7281c, updating cryptography from 41.0.2 to 41.0.3 to address vulnerable OpenSSL bundled in its wheels. | |
| #1272 chore(deps): update dependency cryptography to v41.0.4 [security] | charmcraft | closed | Renovate security bump of cryptography 41.0.3 -> 41.0.4 was closed unmerged by @lengau on 2023-09-21 (flaky store test) in favour of #1271, which landed as commit 431c7387. | |
| #1120 chore(deps): update dependency cryptography to v41 [security] - autoclosed | charmcraft | closed | Autoclosed unmerged; the same cryptography 40.0.2→41.0.0 security update was merged via #1119 in commit 42365b41. | |
| #1056 chore(deps): update dependency cryptography to v39 [security] | charmcraft | closed | Renovate's cryptography 3.4.8->39.0.1 security bump was closed unmerged; maintainer lengau pointed to #1024, which merged as commit 96f6a183 upgrading to 39.0 (plus Rust build deps) and closing #991. | |
| #1057 chore(deps): update dependency cryptography [security] - autoclosed | charmcraft | closed | Renovate’s cryptography 3.4.8→39/40 update was autoclosed unmerged; PR #1119 (commit 42365b41) later merged 40.0.2→41.0.0, superseding it. |