Skip to main content
VulnerabilityPublished Updated

Azure cli: pyca/cryptography's wheels include vulnerable OpenSSL

Affects azure-cliSource GCVE Database

0
Severity
High

Rated by Threat Radar

Patch
Available – fixed in 2.52.0

Data as of 18 Sep 2026, 01:32 UTC

What to do

Upgrade azure-cli to 2.52.0.

Affected software

ProductAffectedFixed in
Homebrewazure-clipkg:brew/azure-cliOther threatsAffected
  • >=2.0.17 <2.52.0
Fixed in
  • 2.52.0

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

A patch is available. Users should update Azure CLI to version 2.52.0 or later, which includes cryptography wheels with patched OpenSSL versions. Users building cryptography from source must upgrade their OpenSSL copy manually. Those installing cryptography from PyPI wheels should update cryptography to a version later than 41.0.2.

Description

The Azure CLI uses pyca/cryptography wheels that include a statically linked vulnerable version of OpenSSL. Versions of OpenSSL included in cryptography releases from 0.8 up to 41.0.2 contain multiple security issues as detailed in OpenSSL security advisories from July 2023. Users installing cryptography from source must upgrade OpenSSL themselves, while those using pre-built wheels from PyPI should update cryptography to a patched version. The affected Azure CLI versions are from 2.0.17 up to but not including 2.52.0.

References

Community reviews

Loading reviews…