USN-8087-2
python-cryptography regression
USN-8087-2 is a vulnerability with no CVSS score yet in python-cryptography, published March 16, 2026. No source lists public exploit code. Fixed in python-cryptography 3.4.8-1ubuntu2.4.
USN-8087-1 fixed a vulnerability in python-cryptography. The update caused a regression when using ECC algorithms with certain software. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that python-cryptography incorrectly handled subgroup validation for SECT curves. A remote attacker could use this issue to perform a subgroup attack and possibly recover the least significant bits of private keys.
What each source reports
OSV No score
python-cryptography regression
USN-8087-1 fixed a vulnerability in python-cryptography. The update caused a regression when using ECC algorithms with certain software. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that python-cryptography incorrectly handled subgroup validation for SECT curves. A remote attacker could use this issue to perform a subgroup attack and possibly recover the least significant bits of private keys.
- Record
USN-8087-2- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
python-cryptographyUbuntu:22.04:LTS |
before 3.4.8-1ubuntu2.4, plus listed versions 3.3.2-13.3.2-1build13.4.8-13.4.8-1ubuntu13.4.8-1ubuntu23.4.8-1ubuntu2.13.4.8-1ubuntu2.23.4.8-1ubuntu2.3 |
3.4.8-1ubuntu2.4 |
python-cryptographyUbuntu:24.04:LTS |
before 41.0.7-4ubuntu0.4, plus listed versions 38.0.4-438.0.4-4ubuntu141.0.7-341.0.7-4build241.0.7-4build341.0.7-4ubuntu0.141.0.7-4ubuntu0.3 |
41.0.7-4ubuntu0.4 |
python-cryptographyUbuntu:25.10 |
before 43.0.0-1ubuntu1.2, plus listed versions 43.0.0-1ubuntu143.0.0-1ubuntu1.1 |
43.0.0-1ubuntu1.2 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-02 | created | OSV |