{"id":"USN-8087-2","summary":"python-cryptography regression","details":"USN-8087-1 fixed a vulnerability in python-cryptography. The update caused\na regression when using ECC algorithms with certain software. This update\nfixes the problem.\n\nWe apologize for the inconvenience.\n\nOriginal advisory details:\n\n It was discovered that python-cryptography incorrectly handled subgroup\n validation for SECT curves. A remote attacker could use this issue to\n perform a subgroup attack and possibly recover the least significant bits\n of private keys.","modified":"2026-03-17T06:42:53.117036Z","published":"2026-03-16T11:35:04Z","references":[{"type":"ADVISORY","url":"https://ubuntu.com/security/notices/USN-8087-2"},{"type":"REPORT","url":"https://launchpad.net/bugs/2144373"}],"affected":[{"package":{"name":"python-cryptography","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/python-cryptography@3.4.8-1ubuntu2.4?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.8-1ubuntu2.4"}]}],"versions":["3.3.2-1","3.3.2-1build1","3.4.8-1","3.4.8-1ubuntu1","3.4.8-1ubuntu2","3.4.8-1ubuntu2.1","3.4.8-1ubuntu2.2","3.4.8-1ubuntu2.3"],"ecosystem_specific":{"availability":"No subscription required","binaries":[{"binary_name":"python3-cryptography","binary_version":"3.4.8-1ubuntu2.4"}]},"database_specific":{"cves_map":{"cves":[],"ecosystem":"Ubuntu:22.04:LTS"},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8087-2.json"}},{"package":{"name":"python-cryptography","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/python-cryptography@41.0.7-4ubuntu0.4?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"41.0.7-4ubuntu0.4"}]}],"versions":["38.0.4-4","38.0.4-4ubuntu1","41.0.7-3","41.0.7-4build2","41.0.7-4build3","41.0.7-4ubuntu0.1","41.0.7-4ubuntu0.3"],"ecosystem_specific":{"availability":"No subscription required","binaries":[{"binary_name":"python3-cryptography","binary_version":"41.0.7-4ubuntu0.4"}]},"database_specific":{"cves_map":{"cves":[],"ecosystem":"Ubuntu:24.04:LTS"},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8087-2.json"}},{"package":{"name":"python-cryptography","ecosystem":"Ubuntu:25.10","purl":"pkg:deb/ubuntu/python-cryptography@43.0.0-1ubuntu1.2?arch=source&distro=questing"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"43.0.0-1ubuntu1.2"}]}],"versions":["43.0.0-1ubuntu1","43.0.0-1ubuntu1.1"],"ecosystem_specific":{"binaries":[{"binary_name":"python3-cryptography","binary_version":"43.0.0-1ubuntu1.2"}],"availability":"No subscription required"},"database_specific":{"cves_map":{"cves":[],"ecosystem":"Ubuntu:25.10"},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8087-2.json"}}],"schema_version":"1.7.5"}