Security update for python-cryptography
Description
This security update for python-cryptography addresses three vulnerabilities: CVE-2026-69247, involving a Bleichenbacher oracle exposure via PKCS#7 EnvelopedData decryption errors and timing; CVE-2026-69248, where the verifier improperly accepts wildcard DNS names allowing escape from permittedSubtrees; and CVE-2026-69249, where duplicate self-signed intermediates can cause exponential path-building. These vulnerabilities affect certain versions of python-cryptography in SUSE products. A patch is available to remediate these issues.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The update for python-cryptography fixes three distinct vulnerabilities. CVE-2026-69247 is a Bleichenbacher oracle exposure related to PKCS#7 EnvelopedData decryption errors and timing side channels. CVE-2026-69248 involves improper verification logic that accepts wildcard DNS names, allowing escape from permittedSubtrees constraints. CVE-2026-69249 concerns duplicate self-signed intermediate certificates that can cause exponential growth in certificate path-building processes. These issues affect specific versions of python-cryptography distributed with SUSE products. A patch has been made available to address these vulnerabilities.
Potential Impact
If exploited, these vulnerabilities could allow attackers to gain information through timing attacks (CVE-2026-69247), bypass DNS name restrictions in certificate verification (CVE-2026-69248), and cause performance degradation or denial of service due to exponential path-building (CVE-2026-69249). The exact impact depends on the usage context of the python-cryptography library within affected SUSE products.
Mitigation Recommendations
A patch is available to remediate these vulnerabilities. Users of affected SUSE python-cryptography packages should apply the security update promptly to mitigate these issues.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- CLEANSTART-2026-CF86587
- Osv Schema Version
- 1.7.3
- Ecosystems
- ["Alpine"]
- State
- PUBLISHED
Threat ID: 6a98455bacd9273b496ab80d
Added to database: 09/02/2026, 15:48:43 UTC
Last enriched: 10/12/2026, 22:36:17 UTC
Last updated: 10/16/2026, 18:48:23 UTC
Views: 81
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.