{"id":"USN-8087-2","aliases":[],"status":"published","title":"python-cryptography regression","description":"USN-8087-1 fixed a vulnerability in python-cryptography. The update caused\na regression when using ECC algorithms with certain software. This update\nfixes the problem.\n\nWe apologize for the inconvenience.\n\nOriginal advisory details:\n\n It was discovered that python-cryptography incorrectly handled subgroup\n validation for SECT curves. A remote attacker could use this issue to\n perform a subgroup attack and possibly recover the least significant bits\n of private keys.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-03-16T11:35:04Z","modified":"2026-03-17T06:42:53Z","fixes":[{"ecosystem":"Ubuntu:22.04:LTS","package":"python-cryptography","fixed_in":["3.4.8-1ubuntu2.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"python-cryptography","fixed_in":["41.0.7-4ubuntu0.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"python-cryptography","fixed_in":["43.0.0-1ubuntu1.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"python-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.8-1ubuntu2.4"}]}],"versions":["3.3.2-1","3.3.2-1build1","3.4.8-1","3.4.8-1ubuntu1","3.4.8-1ubuntu2","3.4.8-1ubuntu2.1","3.4.8-1ubuntu2.2","3.4.8-1ubuntu2.3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"python-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"41.0.7-4ubuntu0.4"}]}],"versions":["38.0.4-4","38.0.4-4ubuntu1","41.0.7-3","41.0.7-4build2","41.0.7-4build3","41.0.7-4ubuntu0.1","41.0.7-4ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"python-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"43.0.0-1ubuntu1.2"}]}],"versions":["43.0.0-1ubuntu1","43.0.0-1ubuntu1.1"]}],"references":[{"url":"https://ubuntu.com/security/notices/USN-8087-2","tags":["advisory"]},{"url":"https://launchpad.net/bugs/2144373","tags":["report"]}],"sources":{"osv":[{"id":"USN-8087-2","title":"python-cryptography regression","description":"USN-8087-1 fixed a vulnerability in python-cryptography. The update caused\na regression when using ECC algorithms with certain software. This update\nfixes the problem.\n\nWe apologize for the inconvenience.\n\nOriginal advisory details:\n\n It was discovered that python-cryptography incorrectly handled subgroup\n validation for SECT curves. A remote attacker could use this issue to\n perform a subgroup attack and possibly recover the least significant bits\n of private keys.","status":"published","published":"2026-03-16T11:35:04Z","modified":"2026-03-17T06:42:53.117036Z","updated_at":"2026-11-02T16:58:22.951676Z"}]}}