Threats Tagged 'cve-2026-69247'

The airflow-3 package version 3.3.1-r1 addresses six security vulnerabilities, including CVE-2026-69247. This release provides fixes for these issues, improving the security posture of the affected software. No specific technical details or CVSS scores are provided for these vulnerabilities. The package is not a cloud service, and no known exploits are reported in the wild at this time.

The az package version 2.89.1-r1 addresses three security vulnerabilities identified as CVE-2026-69247, CVE-2026-69248, and CVE-2026-69249. These vulnerabilities affect versions prior to 2.89.1-r1. A patch is available in version 2.89.1-r1 to remediate these issues. No CVSS score or detailed technical impact information is provided for these vulnerabilities.

This security update for python-cryptography addresses three vulnerabilities: CVE-2026-69247, which involves a Bleichenbacher oracle exposure through distinguishable errors and timing in PKCS#7 EnvelopedData decryption; CVE-2026-69248, where the verifier accepts wildcard DNS names allowing escape from permittedSubtrees; and CVE-2026-69249, where duplicate self-signed intermediates can cause exponential path-building. These issues have been fixed in the updated python-cryptography package.

This update for python-cryptography fixes the following issues: - CVE-2026-69247: PKCS#7 `EnvelopedData` decryption exposes a Bleichenbacher oracle through distinguishable errors and timing (bsc#1273551). - CVE-2026-69248: verifier accepts wildcard DNS names allowing escape from `permittedSubtrees` (bsc#1273549). - CVE-2026-69249: duplicate self-signed intermediates can cause exponential path-building (bsc#1273516).

A timing discrepancy vulnerability exists in the pyca cryptography package versions 44.0.0 up to but not including 50.0.0. The issue involves the pkcs7_decrypt_der, pkcs7_decrypt_pem, and pkcs7_decrypt_smime functions which leak information about the length of the decrypted RSA encryptedKey through observable timing differences and distinct error messages. This leakage can be exploited as a Bleichenbacher oracle against the content-encryption key if an application decrypts attacker-supplied EnvelopedData and reflects the outcome. The vulnerability is fixed in version 50.0.0.