From 0955bbb3a6c4cafe6787b754d6616eaf168a583c Mon Sep 17 00:00:00 2001 From: Mircea Ulinic Date: Fri, 19 Jun 2026 14:26:50 +0100 Subject: [PATCH] CWE-1395 CWE-125: Allow the latest cyrptography library pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in wheels prior to cryptography 48.01 are vulnerable to a security issue. More details about the vulnerability itself can be found at https://openssl-library.org/news/secadv/20260609.txt. I'm unsure why there's a pin to the specific 48.0.1 version, but that effectively prevents us from upgrading to the latest cryptography release that resolves the security issues. I'd also relax the conditions and permit the installation of other future versions. If the maintainers agree with these changes, please release a new minor version on PyPI at your earliest convenience. --- requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/requirements.txt b/requirements.txt index 16f9540a..13bfa21a 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1,5 +1,5 @@ aristaproto==0.1.5 -cryptography==48.0.1 +cryptography>=49.0.0 grpcio>=1.53.0 msgpack>=1.0.3 protobuf>=5.28.3,<6.0dev