Azure cli: pyca/cryptography has a vulnerable OpenSSL included in cryptography wheels
Affects azure-cliSource GCVE Database
Rated by Threat Radar
- Patch
- Available – fixed in 2.65.0
Data as of 18 Sep 2026, 01:32 UTC
What to do
Upgrade azure-cli to 2.65.0.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
Homebrewazure-clipkg:brew/azure-cliOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
A patch is available. Users should upgrade Azure CLI to version 2.65.0 or later, which includes an updated cryptography package with a fixed OpenSSL version. If building cryptography from source, users must ensure they upgrade their OpenSSL dependency accordingly. Users installing cryptography wheels from PyPI should update cryptography to a version beyond 43.0.0 that includes the fix. No additional mitigation steps are indicated by the vendor advisory.
Description
The Azure CLI versions 2.45.0 up to but not including 2.65.0 include pyca/cryptography wheels that contain a statically linked vulnerable version of OpenSSL. This vulnerability originates from the OpenSSL versions bundled within cryptography versions 37.0.0 to 43.0.0. Users who install cryptography from source must manage OpenSSL updates themselves, but those using the pre-built wheels distributed by the cryptography project need to update their cryptography versions to mitigate the issue.