CVE-2026-69248: fallo de gravedad media en pyca cryptography
python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.9epss 0.2%
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In versions 45.0.0 through 48.0.0, if an intermediate constrained CA permits the DNS name foo.example.com, and the leaf certificate has a wildcard in its DNS SAN of *.example.com, python-cryptography's verifier accepts which allows escaping outside of the permitted names. The core issue is in DNSConstraint::matches, where a wildcard pattern was treated as matching a more-specific permitted constraint even though *.example.com can expand to sibling names such as bar.example.com outside foo.example.com. This allows acceptance of an invalid certificate chain. This issue is fixed in 49.0.0.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:P
Productos afectados
pyca · cryptographyCVEs relacionadas — pyca cryptography
En el mismo producto, de las más peligrosas a las menos.
CVE-2023-23931MEDIUMCipher.update_into can corrupt memory in pyca cryptographyEPSS 1.3%CVE-2023-49083MEDIUMcryptography vulnerable to NULL-dereference when loading PKCS7 certificatesEPSS 1.0%CVE-2024-26130HIGHcryptography NULL pointer deference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash overrideEPSS 0.8%CVE-2026-39892MEDIUMcryptography has a buffer overflow if non-contiguous buffers were passed to APIsEPSS 0.7%CVE-2026-26007HIGHcryptography Subgroup Attack Due to Missing Subgroup Validation for SECT CurvesEPSS 0.4%CVE-2026-69247HIGHcryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timingEPSS 0.3%