Loading...
Skip to main content
GeekWala

CVE-2023-0286

HIGH

Vulnerable OpenSSL included in cryptography wheels

Published February 8, 2023Updated July 7, 2026Source: osv

Summary

pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in cryptography 0.8.1-39.0.0 are vulnerable to a security issue. More details about the vulnerabilities themselves can be found in https://www.openssl.org/news/secadv/20221213.txt and https://www.openssl.org/news/secadv/20230207.txt. If you are building cryptography source ("sdist") then you are responsible for upgrading your copy of OpenSSL. Only users installing from wheels built by the cryptography project (i.e., those distributed on PyPI) need to update their cryptography versions.

Remediation

Upgrade to the fixed version using your package manager.

Cargo
Update openssl-src to 111.25.0 or later
cargo update -p openssl-src --precise 111.25.0
Cargo
Update openssl-src to 300.0.12 or later
cargo update -p openssl-src --precise 300.0.12

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (2)

PackageEcosystemAffectedFixed In
openssl-src
crates.io
All versions111.25.0
openssl-src
crates.io
All versions300.0.12

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 7.4 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H

References

Frequently Asked Questions

What is CVE-2023-0286?
Vulnerable OpenSSL included in cryptography wheels This vulnerability has been assigned a severity rating of HIGH (CVSS score: 7.4/10).
How do I check if my project is affected by CVE-2023-0286?
CVE-2023-0286 affects openssl-src. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2023-0286 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
7.4

High exploitability or significant impact. Prioritize remediation within days.

Also Known As

GHSA-x4qr-2fvf-3mr5
PYSEC-2026-800
RUSTSEC-2023-0006

Related CVEs

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies