Skip to content

Bump cryptography from 3.3.2 to 3.4.8 - #7

Closed
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/pip/cryptography-3.4.8
Closed

Bump cryptography from 3.3.2 to 3.4.8#7
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/pip/cryptography-3.4.8

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 13, 2021

Copy link
Copy Markdown

Bumps cryptography from 3.3.2 to 3.4.8.

Changelog

Sourced from cryptography's changelog.

3.4.8 - 2021-08-24


* Updated Windows, macOS, and ``manylinux`` wheels to be compiled with
  OpenSSL 1.1.1l.

.. _v3-4-7:


3.4.7 - 2021-03-25

  • Updated Windows, macOS, and manylinux wheels to be compiled with OpenSSL 1.1.1k.

.. _v3-4-6:

3.4.6 - 2021-02-16


* Updated Windows, macOS, and ``manylinux`` wheels to be compiled with
  OpenSSL 1.1.1j.

.. _v3-4-5:


3.4.5 - 2021-02-13

  • Various improvements to type hints.
  • Lower the minimum supported Rust version (MSRV) to >=1.41.0. This change improves compatibility with system-provided Rust on several Linux distributions.
  • cryptography will be switching to a new versioning scheme with its next feature release. More information is available in our :doc:/api-stability documentation.

.. _v3-4-4:

3.4.4 - 2021-02-09


* Added a ``py.typed`` file so that ``mypy`` will know to use our type
  annotations.
* Fixed an import cycle that could be triggered by certain import sequences.

.. _v3-4-3:


3.4.3 - 2021-02-08

  • Specify our supported Rust version (>=1.45.0) in our setup.py so users

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
Bump cryptography from 3.3.2 to 3.4.8
66fc951 
Bumps [cryptography](https://github.com/pyca/cryptography) from 3.3.2 to 3.4.8.
- [Release notes](https://github.com/pyca/cryptography/releases)
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@3.3.2...3.4.8)

---
updated-dependencies:
- dependency-name: cryptography
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Sep 13, 2021
@dependabot @github

dependabot Bot commented on behalf of github Oct 4, 2021

Copy link
Copy Markdown
Author

Superseded by #16.

@dependabot dependabot Bot closed this Oct 4, 2021
@dependabot
dependabot Bot deleted the dependabot/pip/cryptography-3.4.8 branch October 4, 2021 21:11
thaJeztah added a commit that referenced this pull request Jun 15, 2026
@thaJeztah
chore(deps): golang.org/x/crypto v0.53.0
23d8587 
golang.org/x/crypto v0.52.0 has various fixes for vulnerabilities.
These do NOT impact docker compose, but may show up in vulnerability
scanners;

    govulncheck --version
    Go: go1.26.4
    Scanner: govulncheck@v1.3.0
    DB: https://vuln.go.dev
    DB updated: 2026-06-02 21:39:47 +0000 UTC

    govulncheck -show verbose ./...
    Fetching vulnerabilities from the database...

    Checking the code against the vulnerabilities...

    === Package Results ===

    Vulnerability #1: GO-2026-5023
        Invoking VerifiedPublicKeyCallback permissions skip enforcement in
        golang.org/x/crypto/ssh
      More info: https://pkg.go.dev/vuln/GO-2026-5023
      Module: golang.org/x/crypto
        Found in: golang.org/x/crypto@v0.51.0
        Fixed in: golang.org/x/crypto@v0.52.0

    Vulnerability #2: GO-2026-5020
        Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh
      More info: https://pkg.go.dev/vuln/GO-2026-5020
      Module: golang.org/x/crypto
        Found in: golang.org/x/crypto@v0.51.0
        Fixed in: golang.org/x/crypto@v0.52.0

    Vulnerability #3: GO-2026-5019
        Invoking bypass of FIDO/U2F security keys physical interaction in
        golang.org/x/crypto/ssh
      More info: https://pkg.go.dev/vuln/GO-2026-5019
      Module: golang.org/x/crypto
        Found in: golang.org/x/crypto@v0.51.0
        Fixed in: golang.org/x/crypto@v0.52.0

    Vulnerability #4: GO-2026-5018
        Invoking pathological RSA/DSA parameters may cause DoS in
        golang.org/x/crypto/ssh
      More info: https://pkg.go.dev/vuln/GO-2026-5018
      Module: golang.org/x/crypto
        Found in: golang.org/x/crypto@v0.51.0
        Fixed in: golang.org/x/crypto@v0.52.0

    Vulnerability #5: GO-2026-5017
        Invoking client can cause server deadlock on unexpected responses in
        golang.org/x/crypto/ssh
      More info: https://pkg.go.dev/vuln/GO-2026-5017
      Module: golang.org/x/crypto
        Found in: golang.org/x/crypto@v0.51.0
        Fixed in: golang.org/x/crypto@v0.52.0

    Vulnerability #6: GO-2026-5016
        Invoking memory leak when rejecting channels can lead to DoS in
        golang.org/x/crypto/ssh
      More info: https://pkg.go.dev/vuln/GO-2026-5016
      Module: golang.org/x/crypto
        Found in: golang.org/x/crypto@v0.51.0
        Fixed in: golang.org/x/crypto@v0.52.0

    Vulnerability #7: GO-2026-5015
        Invoking server panic during CheckHostKey/Authenticate in
        golang.org/x/crypto/ssh
      More info: https://pkg.go.dev/vuln/GO-2026-5015
      Module: golang.org/x/crypto
        Found in: golang.org/x/crypto@v0.51.0
        Fixed in: golang.org/x/crypto@v0.52.0

    Vulnerability #8: GO-2026-5014
        Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh
      More info: https://pkg.go.dev/vuln/GO-2026-5014
      Module: golang.org/x/crypto
        Found in: golang.org/x/crypto@v0.51.0
        Fixed in: golang.org/x/crypto@v0.52.0

    Vulnerability #9: GO-2026-5013
        Invoking byte arithmetic causes underflow and panic in

        golang.org/x/crypto/ssh
      More info: https://pkg.go.dev/vuln/GO-2026-5013
      Module: golang.org/x/crypto
        Found in: golang.org/x/crypto@v0.51.0
        Fixed in: golang.org/x/crypto@v0.52.0

    === Module Results ===

    Vulnerability #1: GO-2026-5033
        Invoking pathological inputs can lead to client panic in
        golang.org/x/crypto/ssh/agent
      More info: https://pkg.go.dev/vuln/GO-2026-5033
      Module: golang.org/x/crypto
        Found in: golang.org/x/crypto@v0.51.0
        Fixed in: golang.org/x/crypto@v0.52.0

    Vulnerability #2: GO-2026-5021
        Invoking auth bypass via unenforced @Revoked status in
        golang.org/x/crypto/ssh/knownhosts
      More info: https://pkg.go.dev/vuln/GO-2026-5021
      Module: golang.org/x/crypto
        Found in: golang.org/x/crypto@v0.51.0
        Fixed in: golang.org/x/crypto@v0.52.0

    Vulnerability #3: GO-2026-5006
        Invoking agent constraints dropped when forwarding keys in
        golang.org/x/crypto/ssh/agent
      More info: https://pkg.go.dev/vuln/GO-2026-5006
      Module: golang.org/x/crypto
        Found in: golang.org/x/crypto@v0.51.0
        Fixed in: golang.org/x/crypto@v0.52.0

    Vulnerability #4: GO-2026-5005
        Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent
      More info: https://pkg.go.dev/vuln/GO-2026-5005
      Module: golang.org/x/crypto
        Found in: golang.org/x/crypto@v0.51.0
        Fixed in: golang.org/x/crypto@v0.52.0

    Your code is affected by 2 vulnerabilities from 1 module.
    This scan also found 9 vulnerabilities in packages you import and 4
    vulnerabilities in modules you require, but your code doesn't appear to call
    these vulnerabilities.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
thaJeztah added a commit that referenced this pull request Jun 15, 2026
@thaJeztah @glours
chore(deps): golang.org/x/crypto v0.53.0
cd4f216 
golang.org/x/crypto v0.52.0 has various fixes for vulnerabilities.
These do NOT impact docker compose, but may show up in vulnerability
scanners;

    govulncheck --version
    Go: go1.26.4
    Scanner: govulncheck@v1.3.0
    DB: https://vuln.go.dev
    DB updated: 2026-06-02 21:39:47 +0000 UTC

    govulncheck -show verbose ./...
    Fetching vulnerabilities from the database...

    Checking the code against the vulnerabilities...

    === Package Results ===

    Vulnerability #1: GO-2026-5023
        Invoking VerifiedPublicKeyCallback permissions skip enforcement in
        golang.org/x/crypto/ssh
      More info: https://pkg.go.dev/vuln/GO-2026-5023
      Module: golang.org/x/crypto
        Found in: golang.org/x/crypto@v0.51.0
        Fixed in: golang.org/x/crypto@v0.52.0

    Vulnerability #2: GO-2026-5020
        Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh
      More info: https://pkg.go.dev/vuln/GO-2026-5020
      Module: golang.org/x/crypto
        Found in: golang.org/x/crypto@v0.51.0
        Fixed in: golang.org/x/crypto@v0.52.0

    Vulnerability #3: GO-2026-5019
        Invoking bypass of FIDO/U2F security keys physical interaction in
        golang.org/x/crypto/ssh
      More info: https://pkg.go.dev/vuln/GO-2026-5019
      Module: golang.org/x/crypto
        Found in: golang.org/x/crypto@v0.51.0
        Fixed in: golang.org/x/crypto@v0.52.0

    Vulnerability #4: GO-2026-5018
        Invoking pathological RSA/DSA parameters may cause DoS in
        golang.org/x/crypto/ssh
      More info: https://pkg.go.dev/vuln/GO-2026-5018
      Module: golang.org/x/crypto
        Found in: golang.org/x/crypto@v0.51.0
        Fixed in: golang.org/x/crypto@v0.52.0

    Vulnerability #5: GO-2026-5017
        Invoking client can cause server deadlock on unexpected responses in
        golang.org/x/crypto/ssh
      More info: https://pkg.go.dev/vuln/GO-2026-5017
      Module: golang.org/x/crypto
        Found in: golang.org/x/crypto@v0.51.0
        Fixed in: golang.org/x/crypto@v0.52.0

    Vulnerability #6: GO-2026-5016
        Invoking memory leak when rejecting channels can lead to DoS in
        golang.org/x/crypto/ssh
      More info: https://pkg.go.dev/vuln/GO-2026-5016
      Module: golang.org/x/crypto
        Found in: golang.org/x/crypto@v0.51.0
        Fixed in: golang.org/x/crypto@v0.52.0

    Vulnerability #7: GO-2026-5015
        Invoking server panic during CheckHostKey/Authenticate in
        golang.org/x/crypto/ssh
      More info: https://pkg.go.dev/vuln/GO-2026-5015
      Module: golang.org/x/crypto
        Found in: golang.org/x/crypto@v0.51.0
        Fixed in: golang.org/x/crypto@v0.52.0

    Vulnerability #8: GO-2026-5014
        Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh
      More info: https://pkg.go.dev/vuln/GO-2026-5014
      Module: golang.org/x/crypto
        Found in: golang.org/x/crypto@v0.51.0
        Fixed in: golang.org/x/crypto@v0.52.0

    Vulnerability #9: GO-2026-5013
        Invoking byte arithmetic causes underflow and panic in

        golang.org/x/crypto/ssh
      More info: https://pkg.go.dev/vuln/GO-2026-5013
      Module: golang.org/x/crypto
        Found in: golang.org/x/crypto@v0.51.0
        Fixed in: golang.org/x/crypto@v0.52.0

    === Module Results ===

    Vulnerability #1: GO-2026-5033
        Invoking pathological inputs can lead to client panic in
        golang.org/x/crypto/ssh/agent
      More info: https://pkg.go.dev/vuln/GO-2026-5033
      Module: golang.org/x/crypto
        Found in: golang.org/x/crypto@v0.51.0
        Fixed in: golang.org/x/crypto@v0.52.0

    Vulnerability #2: GO-2026-5021
        Invoking auth bypass via unenforced @Revoked status in
        golang.org/x/crypto/ssh/knownhosts
      More info: https://pkg.go.dev/vuln/GO-2026-5021
      Module: golang.org/x/crypto
        Found in: golang.org/x/crypto@v0.51.0
        Fixed in: golang.org/x/crypto@v0.52.0

    Vulnerability #3: GO-2026-5006
        Invoking agent constraints dropped when forwarding keys in
        golang.org/x/crypto/ssh/agent
      More info: https://pkg.go.dev/vuln/GO-2026-5006
      Module: golang.org/x/crypto
        Found in: golang.org/x/crypto@v0.51.0
        Fixed in: golang.org/x/crypto@v0.52.0

    Vulnerability #4: GO-2026-5005
        Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent
      More info: https://pkg.go.dev/vuln/GO-2026-5005
      Module: golang.org/x/crypto
        Found in: golang.org/x/crypto@v0.51.0
        Fixed in: golang.org/x/crypto@v0.52.0

    Your code is affected by 2 vulnerabilities from 1 module.
    This scan also found 9 vulnerabilities in packages you import and 4
    vulnerabilities in modules you require, but your code doesn't appear to call
    these vulnerabilities.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants