python-cryptography (3.4.8-1ubuntu2.4) jammy-security; urgency=medium

  * SECURITY REGRESSION: ecc support regression (LP: #2144373)
    - debian/patches/CVE-2026-26007.patch: updated to remove problematic
      deprecation warning code which is causing a regression with ansible.

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Sat, 14 Mar 2026 08:22:06 -0400

python-cryptography (3.4.8-1ubuntu2.3) jammy-security; urgency=medium

  * SECURITY UPDATE: Subgroup Attack Due to Missing Subgroup Validation for
    SECT Curves
    - debian/patches/CVE-2026-26007-pre1.patch: check if public keys are at
      infinity earlier in src/cryptography/hazmat/backends/openssl/ec.py,
      tests/hazmat/primitives/test_ec.py.
    - debian/patches/CVE-2026-26007.patch: EC check key on cofactor > 1 in
      src/cryptography/hazmat/primitives/asymmetric/ec.py,
      src/cryptography/utils.py, tests/hazmat/primitives/test_ec.py,
      src/_cffi_src/openssl/ec.py,
      src/cryptography/hazmat/backends/openssl/ec.py.
    - CVE-2026-26007

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Fri, 20 Feb 2026 10:14:37 -0500

python-cryptography (3.4.8-1ubuntu2.2) jammy-security; urgency=medium

  * SECURITY UPDATE: exposure of confidential data
    - debian/patches/CVE-2023-50782.patch: update bindings in
      src/_cffi_src/openssl/rsa.py to be compatible with new openssl version
      3.0.2-0ubuntu1.15, which fixes the issue by changing PKCS#1 v1.5 RSA to 
      return random output instead of an exception when detecting wrong padding
    - CVE-2023-50782 

 -- Jorge Sancho Larraz <jorge.sancho.larraz@canonical.com>  Thu, 29 Feb 2024 12:14:30 +0100

python-cryptography (3.4.8-1ubuntu2.1) jammy-security; urgency=medium

  * SECURITY UPDATE: corrupted output via immutable objects
    - debian/patches/CVE-2023-23931.patch: don't allow update_into to
      mutate immutable objects in tests/hazmat/primitives/test_ciphers.py,
      src/cryptography/hazmat/backends/openssl/ciphers.py.
    - CVE-2023-23931
  * SECURITY UPDATE: DoS via PKCS7 certificate
    - debian/patches/CVE-2023-49083.patch: fix crash when loading a PKCS#7
      bundle with no certificates in
      src/cryptography/hazmat/backends/openssl/backend.py,
      tests/hazmat/primitives/test_pkcs7.py.
    - CVE-2023-49083

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Mon, 04 Dec 2023 14:58:43 -0500

python-cryptography (3.4.8-1ubuntu2) jammy; urgency=medium

  * d/p/skip-test-openssl-memleak.patch: Skip test until fixed upstream.

 -- Corey Bryant <corey.bryant@canonical.com>  Fri, 25 Mar 2022 15:48:46 -0400

python-cryptography (3.4.8-1ubuntu1) jammy; urgency=medium

  * d/p/openssl3/0007-openssl-3.0.1-ftbfs.patch: fix ftbfs with
    openssl 3.0.1 (LP: #1956514)

 -- Andreas Hasenack <andreas@canonical.com>  Wed, 05 Jan 2022 18:30:32 +0000

python-cryptography (3.4.8-1) unstable; urgency=medium

  [ Simon Chopin ]
  * New upstream release.
    - Closes: #995431
  * d/p/no_rust.patch, d/control: Disable the Rust part of the build
    since it's not yet mandatory
  * d/control, d/tests/control: new build-dependency on python-pytest-subtests
    for the testsuite
  * d/p/openssl3/*: Cherry-pick a patchset for OpenSSL3 compatibility.
    - LP: #1946189

  [ Tristan Seligmann ]
  * Update standards version to 4.6.0, no changes needed.
  * Fix Python dir glob for 3.10.

 -- Tristan Seligmann <mithrandi@debian.org>  Wed, 01 Dec 2021 17:54:50 +0200

python-cryptography (3.3.2-1) unstable; urgency=high

  * New upstream release.
    - Fixes CVE-2020-36242.

 -- Tristan Seligmann <mithrandi@debian.org>  Wed, 10 Feb 2021 10:15:26 +0200

python-cryptography (3.3.1-1) unstable; urgency=medium

  [ Sandro Tosi ]
  * Use the new Debian Python Team contact name and address

  [ Tristan Seligmann ]
  * New upstream release.

 -- Tristan Seligmann <mithrandi@debian.org>  Tue, 26 Jan 2021 10:05:25 +0200

python-cryptography (3.2.1-1) unstable; urgency=medium

  [ Ondřej Nový ]
  * d/control: Update Vcs-* fields with new Debian Python Team Salsa
    layout.

  [ Tristan Seligmann ]
  * New upstream release.
    - Closes: #973247 (CVE-2020-25659)

 -- Tristan Seligmann <mithrandi@debian.org>  Sun, 01 Nov 2020 15:22:43 +0200

# For older changelog entries, run 'apt-get changelog python3-cryptography'
