CVE and update status of the FreeBSD ports tree3,295 unaddressed CVEs in 670 portsAll times are CET
CVE details

CVE-2026-34073

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to version 46.0.6, DNS name constraints were only validated against SANs within child certificates, and not the "peer name" presented during each validation. Consequently, cryptography would allow a peer named bar.example.com to validate against a wildcard leaf certificate for *.example.com, even if the leaf's parent certificate (or upwards) contained an excluded subtree constraint for bar.example.com. This issue has been patched in version 46.0.6.

Score
1.7 low
Published
2026-03-31
Links
NVD · cve.org · Report wrong data

Matched ports (1)

PortPackageVersionStatusMaintainer
security/py-cryptography-legacypy312-cryptography-legacy3.4.8_3,1unaddressedsunpoet@FreeBSD.org

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>py312-cryptography-legacy</name>
	<range><lt>46.0.6</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>cryptography is a package designed to expose cryptographic primitives
	and recipes to Python developers. Prior to version 46.0.6, DNS name
	constraints were only validated against SANs within child
	certificates, and not the "peer name" presented during each
	validation. Consequently, cryptography would allow a peer named
	bar.example.com to validate against a wildcard leaf certificate for
	*.example.com, even if the leaf's parent certificate (or upwards)
	contained an excluded subtree constraint for bar.example.com. This
	issue has been patched in version 46.0.6.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-34073</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-34073</url>
    </references>
    <dates>
      <discovery>2026-03-31</discovery>
      <entry>2026-10-26</entry>
    </dates>
  </vuln>