security/py-cryptography-legacy: Fix deprecated CPE_VENDORc5583e119d
Port details
security/py-cryptography-legacy 3.4.8_3,1
Cryptographic recipes and primitives for Python developers
Port info
- Maintainer
- sunpoet@FreeBSD.org
- Packages
- latest: 3.4.8_3,1
- Upstream
- up to date
- Last update
- to 3.4.8_3,1 · c5583e119d
- Quarterly
- 2026Q4: 3.4.8_3,1
- WWW
- https://github.com/pyca/cryptography
- Links
- cgit · VuXML
Install
- Package
# pkg install py312-cryptography-legacyinstalls 3.4.8_3,1 fromlatest; fromquarterly(2026Q4) 3.4.8_3,1- Port
# cd /usr/ports/security/py-cryptography-legacy && make install clean- Size
- 471 KiB download · 3.4 MiB installed
- Depends on
- devel/py-cffi 2.1.1, lang/python312 3.12.15
- License
- APACHE20 or BSD3CLAUSE
Packages by version and architecture
latest
| FreeBSD version | amd64 | aarch64 | i386 |
|---|---|---|---|
| FreeBSD 16 | 3.4.8_3,1 | 3.4.8_3,1 | – |
| FreeBSD 15 | 3.4.8_3,1 | 3.4.8_3,1 | – |
| FreeBSD 14 | 3.4.8_3,1 | 3.4.8_3,1 | 3.4.8_3,1 |
quarterly (2026Q4)
| FreeBSD version | amd64 | aarch64 | i386 |
|---|---|---|---|
| FreeBSD 15 | 3.4.8_3,1 | 3.4.8_3,1 | – |
| FreeBSD 14 | 3.4.8_3,1 | 3.4.8_3,1 | 3.4.8_3,1 |
version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.
Unaddressed (5)
The CVE record lists the packaged version 3.4.8_3,1 as affected, and no VuXML entry names the CVE. What does this mean?
No fix in the 3.x branch: all 5 unaddressed CVEs are fixed in 46.0.6, available as security/py-cryptography (50.0.1_1,1).
Fixed up to each version, cumulative: 39.0.1 1 · 41.0.6 2 · 42.0.0 3 · 46.0.5 4 · 46.0.6 5
| CVE | CVSS | Published | Description |
|---|---|---|---|
| CVE-2026-26007 | 8.2 | 2026-02-10 | cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to 46.0.5, the public_key_from_numbers (or EllipticCurvePub… |
| CVE-2023-50782 | 7.5 | 2024-02-05 | A flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which… |
| CVE-2023-49083 | 5.9 | 2023-11-29 | cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling `load_pem_pkcs7_certificates` or `load_der_pkcs7_certific… |
| CVE-2023-23931 | 4.8 | 2023-02-07 | cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In affected versions `Cipher.update_into` would accept Python obj… |
| CVE-2026-34073 | 1.7 | 2026-03-31 | cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to version 46.0.6, DNS name constraints were only validated… |
VuXML only (0)
Listed in VuXML, the packaged version 3.4.8_3,1 is still in the affected range; pkg audit reports it. What does this mean?
None.
Fixed (0)
No VuXML entries for this package.
Problem reports (0) · open in Bugzilla, most recently changed first
None.
Commits (5)
all: drop support for FreeBSD 13.2 which reached EOL today Thanks again to jbeich for noticing various things I overlooked. Reviewed by: acm, ashish, eduardo, ehaupt, eugen, jbeich, martymac, mat, nobukata, sunpoet, tagattie, yuri, arrowd, kde Differential Revision: https://reviews.freebsd.org/D4514119d68720f1
security/py-cryptography-legacy: fix OpenSSL >= 3.0 compat py-cryptography-legacy still references functions that have been removed in OpenSSL 3.0, and fails to load openssl.abi3.so at run-time because it lacks ERR_GET_FUNC (reported) and FIPS_mode (masked by first error), and later because py-openssl feeds our utils/deprecated() an unsupported name=<some string> keyword argument. https://www.openssl.org/docs/man3.0/man7/migration_guide.html is the basis for fixes #1 and #2 removed, because OpenSSL 3.0 removed function codes from the error. In our own binding, leave the err_func attribute in, but set it to a constant 0. (patch-src___cffi* and patch-*binding.py) and FIPS_mode_set, which need rework. (patch-libressl) our utils/deprecated() function does not support, so steal the utils function from py-cryptography 42.0.7,1, drop the argument and return type annotations for consistency. (patch-src_cryptography_utils.py) This is sufficient to fix run-time errors for py-certbot on my FreeBSD 14.0-RELEASE-p6 amd64 server with Python 3.11, which I set to default to py-cryptography-legacy. PR: 272935 (and bug linkage will reflect changes in PRs 273770, 272885) Approved by: portmgr@ (just-fix-it blanket approval) MFH: 2024Q2403f201a14
security/py-cryptography-legacy: Convert to USE_PYTHON=pep517 - Bump PORTREVISION for package change1e503b0355
security/py-cryptography: copy port to -legacy variant prior to update A future commit will update to security/py-cryptography will introduce a rust dependency. PR: 254853c380909c80