[GHSA-m2h6-j472-rp4c] python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees - #9714
Conversation
|
Hi there @alex! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository. This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory |
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
Restore /E:P and retain the affected-version metadata with the corrected < 49.0.0 range.
Get a fresh assessment by requesting another Copilot review.
Review effort: Balanced
Findings: 2
Open (2)
What changed in this PR
Updates metadata for the python-cryptography wildcard DNS verifier vulnerability.
Changes:
- Raises severity to HIGH.
- Removes the CVSS
E:Pmetric, which must be restored. - Removes the affected-version range instead of updating it to
< 49.0.0.
| File | Description |
|---|---|
advisories/github-reviewed/2026/08/GHSA-m2h6-j472-rp4c/GHSA-m2h6-j472-rp4c.json |
Updates severity, CVSS scoring, and affected-version metadata. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| { | ||
| "type": "CVSS_V4", | ||
| "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:P" | ||
| "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N" |
| ] | ||
| } | ||
| ], |
|
I don't know what is going on here. CVSS isn't real and should be ignored, and the severity change is wrong. If the goal was to fix the version, then this should fix it, not delete it. Github: could you please update your bot to filter PRs for basic sanity before tagging people? |
|
hi @alex. Same as #9713. The form generates this diff for a range change. I changed the affected range from >= 45.0.0, <= 48.0.0 to >= 45.0.0, < 49.0.0, and database_specific is dropped because the range then agrees with "fixed": "49.0.0". The CVSS change is not mine, as I wrote in the PR description. The form refuses to submit a vector with a non-base metric (#5357), so I had to remove E:P, and the severity was recomputed from the shortened vector. I cannot edit this branch, so the curation team will have to restore E:P and the MODERATE severity. |
|
Version fix is fine then, I can't approve because the severity is wrong. Need someone from github to fix. |
Updates
Comments
The range should end at < 49.0.0, not <= 48.0.0.
The fix pyca/cryptography@4d035a4 (#14888) is in tag 49.0.0 and not in tag 48.0.1. Version 48.0.1 came out after 48.0.0 and only rebuilds the wheels with OpenSSL 4.0.1, see the changelog.
So version 48.0.1 is still vulnerable but is outside the current range.
The form does not accept the E:P metric in the CVSS 4.0 vector (see #5357), so I had to remove it. Please restore it.