cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 44.0.0 until 50.0.0, pkcs7_decrypt_der, pkcs7_decrypt_pem, and pkcs7_decrypt_smime reported the outcome of decrypting a RecipientInfo's encryptedKey in several distinguishable ways, one of which disclosed the exact length recovered from the RSA operation. The same distinction was also observable by timing. An application that decrypts attacker-supplied EnvelopedData and reflects the outcome gives the attacker a Bleichenbacher oracle against the content-encryption key. Decryption ran as RSA PKCS#1 v1.5 decrypt of encryptedKey, build an AES cipher from the result, then AES-CBC decrypt and PKCS#7 unpad. Invalid RSA padding, a valid padding with a bad key length, a correct length with a wrong key, and the real key each failed or succeeded differently. Case 1 is reachable only where the linked library lacks implicit rejection: OpenSSL 3.0 and 3.1, LibreSSL, and BoringSSL. Exploitation requires a service that auto-decrypts untrusted EnvelopedData matching the victim certificate and answers adaptively at high volume, such as an S/MIME gateway or mail filter. This issue is fixed in 50.0.0.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - cryptography is a package designed to expose cryptographic primitives and recipes to Python developers.
    From 44.0.0 until 50.0.0, pkcs7_decrypt_der, pkcs7_decrypt_pem, and pkcs7_decrypt_smime reported the
    outcome of decrypting a RecipientInfo's encryptedKey in several distinguishable ways, one of which
    disclosed the exact length recovered from the RSA operation. The same distinction was also observable by
    timing. An application that decrypts attacker-supplied EnvelopedData and reflects the outcome gives the
    attacker a Bleichenbacher oracle against the content-encryption key. Decryption ran as RSA PKCS#1 v1.5
    decrypt of encryptedKey, build an AES cipher from the result, then AES-CBC decrypt and PKCS#7 unpad.
    Invalid RSA padding, a valid padding with a bad key length, a correct length with a wrong key, and the
    real key each failed or succeeded differently. Case 1 is reachable only where the linked library lacks
    implicit rejection: OpenSSL 3.0 and 3.1, LibreSSL, and BoringSSL. Exploitation requires a service that
    auto-decrypts untrusted EnvelopedData matching the victim certificate and answers adaptively at high
    volume, such as an S/MIME gateway or mail filter. This issue is fixed in 50.0.0. (CVE-2026-69247)

The remote Ubuntu 18.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8776-1 advisory.

    It was discovered that python-cryptography incorrectly accepted objects with immutable buffers when     performing certain cipher operations. This would result in corrupted output, contrary to expectations.
    This issue only affected Ubuntu 18.04 LTS. (CVE-2023-23931)

    It was discovered that python-cryptography reported the outcome of decrypting PKCS#7 enveloped data in     distinguishable ways, and with observable timing differences. A remote attacker could possibly use this     issue to recover the key used to encrypt the message contents, and obtain sensitive information. This     issue only affected Ubuntu 26.04 LTS. (CVE-2026-69247)

    Jack Lloyd discovered that python-cryptography incorrectly handled wildcard DNS names when enforcing the     name constraints of a certificate authority. A remote attacker could possibly use this issue to have an     invalid certificate chain accepted, and use names outside of the permitted ones. This issue only affected     Ubuntu 26.04 LTS. (CVE-2026-69248)

    Samuel Judson discovered that python-cryptography incorrectly handled certificate chains that contained     duplicate certificates. A remote attacker could possibly use this issue to cause python-cryptography to     use excessive resources, leading to a denial of service. This issue only affected Ubuntu 26.04 LTS.
    (CVE-2026-69249)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21685-1 advisory.

    - CVE-2026-69247: PKCS#7 `EnvelopedData` decryption exposes a Bleichenbacher oracle through     distinguishable errors and       timing (bsc#1273551).
    - CVE-2026-69248: verifier accepts wildcard DNS names allowing escape from `permittedSubtrees`     (bsc#1273549).
    - CVE-2026-69249: duplicate self-signed intermediates can cause exponential path-building (bsc#1273516).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-9f07e6bc2b advisory.

    Includes a fix for CVE-2026-69247, refer to     https://github.com/pyca/cryptography/security/advisories/GHSA-g6cj-pr64-35w5 for a more detailed     description.

    Full changelog: https://github.com/pyca/cryptography/blob/50.0.0/CHANGELOG.rst

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - cryptography is a package designed to expose cryptographic primitives and recipes to Python developers.
    From 44.0.0 until 50.0.0, pkcs7_decrypt_der, pkcs7_decrypt_pem, and pkcs7_decrypt_smime reported the     outcome of decrypting a RecipientInfo's encryptedKey in several distinguishable ways, one of which     disclosed the exact length recovered from the RSA operation. The same distinction was also observable by     timing. An application that decrypts attacker-supplied EnvelopedData and reflects the outcome gives the     attacker a Bleichenbacher oracle against the content-encryption key. Decryption ran as RSA PKCS#1 v1.5     decrypt of encryptedKey, build an AES cipher from the result, then AES-CBC decrypt and PKCS#7 unpad.
    Invalid RSA padding, a valid padding with a bad key length, a correct length with a wrong key, and the     real key each failed or succeeded differently. Case 1 is reachable only where the linked library lacks     implicit rejection: OpenSSL 3.0 and 3.1, LibreSSL, and BoringSSL. Exploitation requires a service that     auto-decrypts untrusted EnvelopedData matching the victim certificate and answers adaptively at high     volume, such as an S/MIME gateway or mail filter. This issue is fixed in 50.0.0. (CVE-2026-69247)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
458963	Echo: cryptography: security update to 50.0.0	Tenable Cloud Security	Echo Local Security Checks	Local	high
458963	Echo: cryptography: security update to 50.0.0	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
346812	Ubuntu 18.04 LTS / 26.04 LTS : python-cryptography vulnerabilities (USN-8776-1)	Nessus	Ubuntu Local Security Checks	Local	high
342112	openSUSE 16 Security Update : python-cryptography (openSUSE-SU-2026:21685-1)	Nessus	SuSE Local Security Checks	Local	high
341358	Fedora 44 : pyOpenSSL / python-cryptography / python-pynitrokey (2026-9f07e6bc2b)	Nessus	Fedora Local Security Checks	Local	high
445592	SCA: security update for cryptography (GHSA-g6cj-pr64-35w5)	Tenable Cloud Security	SCA Checks	Local	high
445592	SCA: security update for cryptography (GHSA-g6cj-pr64-35w5)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
331896	Linux Distros Unpatched Vulnerability : CVE-2026-69247	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-69247

high

Tenable Plugins

high

high

high

high

high

high

high

high