The pyca/cryptography Python package bundles a statically linked OpenSSL library that is vulnerable in versions 0.8 through 41.0.2. These OpenSSL versions have multiple security vulnerabilities as documented in OpenSSL advisories published in July 2023. The Azure CLI versions from 2.0.17 to before 2.52.0 include these vulnerable cryptography wheels, thus inheriting the OpenSSL vulnerabilities. Users building cryptography from source must manually upgrade OpenSSL, while users installing from cryptography wheels distributed on PyPI should update to a fixed cryptography version. This vulnerability affects the Azure CLI but is remediated by updating cryptography and Azure CLI to versions including patched OpenSSL.

The impact arises from multiple security issues in the OpenSSL versions statically linked in pyca/cryptography wheels used by Azure CLI versions 2.0.17 to before 2.52.0. These vulnerabilities could potentially affect the security of cryptographic operations within Azure CLI. No known exploits in the wild have been reported. The exact impact depends on the specific OpenSSL vulnerabilities detailed in the referenced OpenSSL advisories.

A patch is available. Users should update Azure CLI to version 2.52.0 or later, which includes cryptography wheels with patched OpenSSL versions. Users building cryptography from source must upgrade their OpenSSL copy manually. Those installing cryptography from PyPI wheels should update cryptography to a version later than 41.0.2. No additional action is required beyond updating to fixed versions.