Describe the bug
The bundled-build requirements pin cryptography==46.0.7 in all three platform files (src/azure-cli/requirements.py3.{Linux,Darwin,windows}.txt). That version is affected by GHSA-537c-gmf6-5ccf — "Vulnerable OpenSSL included in cryptography wheels" (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/…/A:H). Per OSV the fix is cryptography 48.0.1.
The reason I'm filing an issue rather than a PR: it isn't a clean one-line bump. The same files pin pyOpenSSL==26.0.0, whose metadata requires cryptography<47,>=46.0.0 — so bumping cryptography to 48.0.1 alone would break resolution. Fixing it properly is a coordinated bump:
cryptography → ≥ 48.0.1 (fixed), andpyOpenSSL → a version that permits it — e.g. the current pyOpenSSL 26.3.0 requires cryptography>=49.0.0,<50, which would pull cryptography 49.x (also ≥ the 48.0.1 fix).
Because these are your generated bundled-build pins (MSI/deb/rpm/Homebrew), the exact coordinated set is yours to regenerate and validate — I didn't want to hand you a requirements diff that might not resolve against the other ~140 pins.
Related
To Reproduce
grep -H cryptography== src/azure-cli/requirements.py3.*.txt # cryptography==46.0.7
curl -s https://api.osv.dev/v1/vulns/GHSA-537c-gmf6-5ccf | jq .affected # fixed: 48.0.1
curl -s https://pypi.org/pypi/pyOpenSSL/26.0.0/json | jq '.info.requires_dist[]' | grep crypto # cryptography<47,>=46.0.0
Expected behavior
Bundled azure-cli ships cryptography ≥ 48.0.1 (with a compatible pyOpenSSL), clearing GHSA-537c-gmf6-5ccf.
I'm happy to prepare the coordinated requirements PR if you confirm the pyOpenSSL/cryptography pair you'd like. For transparency: I used AI assistance in preparing this; I verified the pins, the advisory, and the pyOpenSSL constraint myself.
Describe the bug
The bundled-build requirements pin
cryptography==46.0.7in all three platform files (src/azure-cli/requirements.py3.{Linux,Darwin,windows}.txt). That version is affected by GHSA-537c-gmf6-5ccf — "Vulnerable OpenSSL included in cryptography wheels" (CVSS 7.5,AV:N/AC:L/PR:N/UI:N/…/A:H). Per OSV the fix is cryptography 48.0.1.The reason I'm filing an issue rather than a PR: it isn't a clean one-line bump. The same files pin
pyOpenSSL==26.0.0, whose metadata requirescryptography<47,>=46.0.0— so bumping cryptography to 48.0.1 alone would break resolution. Fixing it properly is a coordinated bump:cryptography→ ≥ 48.0.1 (fixed), andpyOpenSSL→ a version that permits it — e.g. the currentpyOpenSSL 26.3.0requirescryptography>=49.0.0,<50, which would pull cryptography 49.x (also ≥ the 48.0.1 fix).Because these are your generated bundled-build pins (MSI/deb/rpm/Homebrew), the exact coordinated set is yours to regenerate and validate — I didn't want to hand you a requirements diff that might not resolve against the other ~140 pins.
Related
/tools/aaz-flow(dev tooling), not these shipped requirements files.To Reproduce
Expected behavior
Bundled azure-cli ships cryptography ≥ 48.0.1 (with a compatible pyOpenSSL), clearing GHSA-537c-gmf6-5ccf.
I'm happy to prepare the coordinated requirements PR if you confirm the pyOpenSSL/cryptography pair you'd like. For transparency: I used AI assistance in preparing this; I verified the pins, the advisory, and the pyOpenSSL constraint myself.