update cryptography to fix CVE-2023-50782, CVE-2024-6119, CVE-2024-26130

, CVE-2023-49083
crim-ca · Mar 5, 2025 · 02839f4 · 02839f4
1 parent eaa57d8
commit 02839f4
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 2 deletions.
diff --git a/CHANGES.rst b/CHANGES.rst
@@ -16,7 +16,11 @@ Changes:
 
 Fixes:
 ------
-- No change.
+- Pin ``cryptography>=44.0.1`` to address vulnerabilities
+  `CVE-2023-50782 <https://nvd.nist.gov/vuln/detail/CVE-2023-50782>`_,
+  `CVE-2024-6119 <https://nvd.nist.gov/vuln/detail/CVE-2024-6119>`_,
+  `CVE-2024-26130 <https://nvd.nist.gov/vuln/detail/CVE-2024-26130>`_,
+  `CVE-2023-49083 <https://nvd.nist.gov/vuln/detail/CVE-2023-49083>`_.
 
 .. _changes_6.4.0:
 

diff --git a/requirements.txt b/requirements.txt
@@ -35,7 +35,7 @@ colander<2
 cornice
 #cornice_swagger>=0.7.0
 cornice-swagger @ git+https://github.com/fmigneault/cornice.ext.swagger.git@openapi-3
-cryptography
+cryptography>=44.0.1
 # FIXME: properly support GPU execution
 #   - https://github.com/crim-ca/weaver/issues/104
 #   - https://github.com/crim-ca/weaver/issues/138