Threats affecting pkg:brew/azure-cli

The Azure CLI versions 2.45.0 up to but not including 2.65.0 include pyca/cryptography wheels that contain a statically linked vulnerable version of OpenSSL. This vulnerability originates from the OpenSSL versions bundled within cryptography versions 37.0.0 to 43.0.0. Users who install cryptography from source must manage OpenSSL updates themselves, but those using the pre-built wheels distributed by the cryptography project need to update their cryptography versions to mitigate the issue.

The Azure CLI uses pyca/cryptography wheels that include a statically linked vulnerable version of OpenSSL. Versions of OpenSSL included in cryptography releases from 0.8 up to 41.0.2 contain multiple security issues as detailed in OpenSSL security advisories from July 2023. Users installing cryptography from source must upgrade OpenSSL themselves, while those using pre-built wheels from PyPI should update cryptography to a patched version. The affected Azure CLI versions are from 2.0.17 up to but not including 2.52.0.

The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fix(es): * python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens (CVE-2026-48526) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fix(es): * cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves (CVE-2026-26007) * pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 ?4.1.11 MUST violation) (CVE-2026-32597) * pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion (CVE-2026-30922) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat Enterprise Linux (RHEL) ist eine populäre Linux-Distribution.

This update includes the following RPMs:

PyJWT versions prior to certain fixed releases do not validate the 'crit' (Critical) header parameter in JSON Web Signature (JWS) tokens as required by RFC 7515 §4.1.11. This allows tokens containing unknown critical extensions to be accepted instead of rejected, violating the RFC and potentially enabling security policy bypasses. The vulnerability is similar to CVE-2025-59420 affecting Authlib and has a CVSS score of 7.5 (High).

This update for python-azure-core fixes the following issues: - CVE-2026-21226: Fixed deserialization of untrusted data which may allow an authorized attacker to execute code over a network. (bsc#1257703)

pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in cryptography 42.0.0-44.0.0 are vulnerable to a security issue. More details about the vulnerability itself can be found in https://openssl-library.org/news/secadv/20250211.txt. If you are building cryptography source ("sdist") then you are responsible for upgrading your copy of OpenSSL. Only users installing from wheels built by the cryptography project (i.e., those distributed on PyPI) need to update their cryptography versions.