Azure cli: pyca/cryptography has a vulnerable OpenSSL included in cryptography wheels
The Azure CLI versions 2.45.0 up to but not including 2.65.0 include pyca/cryptography wheels that contain a statically linked vulnerable version of OpenSSL. This vulnerability originates from the OpenSSL versions bundled within cryptography versions 37.0.0 to 43.0.0. Users who install cryptography from source must manage OpenSSL updates themselves, but those using the pre-built wheels distributed by the cryptography project need to update their cryptography versions to mitigate the issue.
AI Analysis
Technical Summary
The pyca/cryptography library, used by Azure CLI versions >=2.45.0 <2.65.0, includes statically linked OpenSSL versions that are vulnerable to a security issue detailed in the OpenSSL security advisory dated 2024-09-03. This vulnerability affects cryptography versions 37.0.0 through 43.0.0. The cryptography project distributes pre-built wheels containing the vulnerable OpenSSL, and users installing these wheels need to update cryptography to a fixed version. Users building cryptography from source must upgrade OpenSSL independently. The Azure CLI versions in the specified range are impacted due to their dependency on these cryptography wheels.
Potential Impact
Azure CLI versions from 2.45.0 up to but not including 2.65.0 are affected because they include cryptography wheels with a vulnerable OpenSSL. The specific security issue is documented by the OpenSSL project, but no active exploitation is reported. The vulnerability could potentially expose users to risks associated with the underlying OpenSSL flaw, depending on the nature of the vulnerability described in the OpenSSL advisory.
Mitigation Recommendations
A patch is available. Users should upgrade Azure CLI to version 2.65.0 or later, which includes an updated cryptography package with a fixed OpenSSL version. If building cryptography from source, users must ensure they upgrade their OpenSSL dependency accordingly. Users installing cryptography wheels from PyPI should update cryptography to a version beyond 43.0.0 that includes the fix. No additional mitigation steps are indicated by the vendor advisory.
Azure cli: pyca/cryptography has a vulnerable OpenSSL included in cryptography wheels
Description
The Azure CLI versions 2.45.0 up to but not including 2.65.0 include pyca/cryptography wheels that contain a statically linked vulnerable version of OpenSSL. This vulnerability originates from the OpenSSL versions bundled within cryptography versions 37.0.0 to 43.0.0. Users who install cryptography from source must manage OpenSSL updates themselves, but those using the pre-built wheels distributed by the cryptography project need to update their cryptography versions to mitigate the issue.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The pyca/cryptography library, used by Azure CLI versions >=2.45.0 <2.65.0, includes statically linked OpenSSL versions that are vulnerable to a security issue detailed in the OpenSSL security advisory dated 2024-09-03. This vulnerability affects cryptography versions 37.0.0 through 43.0.0. The cryptography project distributes pre-built wheels containing the vulnerable OpenSSL, and users installing these wheels need to update cryptography to a fixed version. Users building cryptography from source must upgrade OpenSSL independently. The Azure CLI versions in the specified range are impacted due to their dependency on these cryptography wheels.
Potential Impact
Azure CLI versions from 2.45.0 up to but not including 2.65.0 are affected because they include cryptography wheels with a vulnerable OpenSSL. The specific security issue is documented by the OpenSSL project, but no active exploitation is reported. The vulnerability could potentially expose users to risks associated with the underlying OpenSSL flaw, depending on the nature of the vulnerability described in the OpenSSL advisory.
Mitigation Recommendations
A patch is available. Users should upgrade Azure CLI to version 2.65.0 or later, which includes an updated cryptography package with a fixed OpenSSL version. If building cryptography from source, users must ensure they upgrade their OpenSSL dependency accordingly. Users installing cryptography wheels from PyPI should update cryptography to a version beyond 43.0.0 that includes the fix. No additional mitigation steps are indicated by the vendor advisory.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BREW-azure-cli-GHSA-h4gh-qq45-vh27
- Osv Schema Version
- 1.7.3
- Ecosystems
- ["Homebrew"]
Threat ID: 6aac8e0555bf5e2cf549039d
Added to database: 09/18/2026, 01:04:05 UTC
Last enriched: 09/18/2026, 01:32:51 UTC
Last updated: 09/18/2026, 01:32:51 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.