Skip to content
OpenAdvisories
Unscored USN-8087-2 0 CVEs

python-cryptography regression

Published Mar 16, 2026 · Updated Mar 17, 2026

Summary

USN-8087-1 fixed a vulnerability in python-cryptography. The update caused
a regression when using ECC algorithms with certain software. This update
fixes the problem.

We apologize for the inconvenience.

Original advisory details:

It was discovered that python-cryptography incorrectly handled subgroup
validation for SECT curves. A remote attacker could use this issue to
perform a subgroup attack and possibly recover the least significant bits
of private keys.

Fixed packages 3

ReleasePackageFixed in
Ubuntu · 22.04 LTS 22.04:LTS python-cryptography 3.4.8-1ubuntu2.4
Ubuntu · 24.04 LTS 24.04:LTS python-cryptography 41.0.7-4ubuntu0.4
Ubuntu · 25.10 python-cryptography 43.0.0-1ubuntu1.2

References

  • report
    https://launchpad.net/bugs/2144373