[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fHbGtpLeuG3kw5mnGSq7bfuNpkgsQIwrSUk9qgvB_6aQ":3},{"success":4,"data":5},true,{"vendor":6,"topVulnerabilitiesByEpss":20,"kevVulnerabilities":69,"topProductsByCves":70,"seoMetadata":72,"meta":81},{"vendorId":7,"vendorName":8,"productCount":9,"cveCount":10,"kevCount":11,"versionCount":12,"lastCveUpdate":13,"firstLetter":14,"products":15,"description":19},6762,"cryptography.io",1,8,0,151,"2024-02-21","c",[16],{"id":17,"product_name":18,"version_count":12,"cve_count":10,"kev_count":11,"last_cve_update":13},30185,"cryptography","Cryptography.io is a technology vendor with 1 tracked product and 8 known security vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this vendor.",[21,30,37,44,50,55,60,64],{"cveId":22,"description":23,"publishedDate":24,"cvssScore":25,"cvssVersion":26,"severity":27,"isKev":28,"epssScore":29},"CVE-2020-36242","In the cryptography package before 3.3.2 for Python, certain sequences of update calls to symmetrically encrypt multi-GB values could result in an integer overflow and buffer overflow, as demonstrated by the Fernet class.","2021-02-07",9.1,"v3.1","Critical",false,0.06718,{"cveId":31,"description":32,"publishedDate":33,"cvssScore":34,"cvssVersion":26,"severity":35,"isKev":28,"epssScore":36},"CVE-2016-9243","HKDF in cryptography before 1.5.2 returns an empty byte-string if used with a length less than algorithm.digest_size.","2017-03-27",7.5,"High",0.03464,{"cveId":38,"description":39,"publishedDate":40,"cvssScore":41,"cvssVersion":26,"severity":42,"isKev":28,"epssScore":43},"CVE-2020-25659","python-cryptography 3.2 is vulnerable to Bleichenbacher timing attacks in the RSA decryption API, via timed processing of valid PKCS#1 v1.5 ciphertext.","2021-01-11",5.9,"Medium",0.02463,{"cveId":45,"description":46,"publishedDate":47,"cvssScore":48,"cvssVersion":26,"severity":42,"isKev":28,"epssScore":49},"CVE-2023-23931","cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In affected versions `Cipher.update_into` would accept Python objects which implement the buffer protocol, but provide only immutable buffers. This would allow immutable objects (such as `bytes`) to be mutated, thus violating fundamental rules of Python and resulting in corrupted output. This now correctly raises an exception. This issue has been present since `update_into` was originally introduced in cryptography 1.8.","2023-02-07",4.8,0.01301,{"cveId":51,"description":52,"publishedDate":53,"cvssScore":34,"cvssVersion":26,"severity":35,"isKev":28,"epssScore":54},"CVE-2023-50782","A flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data.","2024-02-05",0.01118,{"cveId":56,"description":57,"publishedDate":58,"cvssScore":41,"cvssVersion":26,"severity":42,"isKev":28,"epssScore":59},"CVE-2023-49083","cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling `load_pem_pkcs7_certificates` or `load_der_pkcs7_certificates` could lead to a NULL-pointer dereference and segfault. Exploitation of this vulnerability poses a serious risk of Denial of Service (DoS) for any application attempting to deserialize a PKCS7 blob\u002Fcertificate. The consequences extend to potential disruptions in system availability and stability. This vulnerability has been patched in version 41.0.6.","2023-11-29",0.00985,{"cveId":61,"description":62,"publishedDate":13,"cvssScore":34,"cvssVersion":26,"severity":35,"isKev":28,"epssScore":63},"CVE-2024-26130","cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Starting in version 38.0.0 and prior to version 42.0.4, if `pkcs12.serialize_key_and_certificates` is called with both a certificate whose public key did not match the provided private key and an `encryption_algorithm` with `hmac_hash` set (via `PrivateFormat.PKCS12.encryption_builder().hmac_hash(...)`, then a NULL pointer dereference would occur, crashing the Python process. This has been resolved in version 42.0.4, the first version in which a `ValueError` is properly raised.",0.00831,{"cveId":65,"description":66,"publishedDate":67,"cvssScore":34,"cvssVersion":26,"severity":35,"isKev":28,"epssScore":68},"CVE-2023-38325","The cryptography package before 41.0.2 for Python mishandles SSH certificates that have critical options.","2023-07-14",0.00732,[],[71],{"id":17,"product_name":18,"version_count":12,"cve_count":10,"kev_count":11,"last_cve_update":13},{"title":73,"metaDescription":74,"keywords":75,"structuredData":76},"Cryptography.io - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Cryptography.io covering 1 product with 8 tracked vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Cryptography.io vulnerabilities, Cryptography.io security, Cryptography.io CVE, Cryptography.io threat intelligence, vendor security analysis, cybersecurity threats, vulnerability management, CVE tracking",{"@context":77,"@type":78,"name":79,"description":74,"url":80},"https:\u002F\u002Fschema.org","Organization","Cryptography.io","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Fcryptography.io",{"totalProducts":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":13,"generatedAt":82,"apiVersion":83},"2026-10-18T23:31:25.490Z","3.0"]