CWE-1395 CWE-125: Allow the latest cryptography library

[mirceaulinic]

pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in wheels prior to cryptography 48.01 are vulnerable to a security issue.
More details about the vulnerability itself can be found at https://openssl-library.org/news/secadv/20260609.txt.

I'm unsure why there's a pin to the specific 48.0.1 version, but that effectively prevents us from upgrading to the latest cryptography release that resolves the security issues.

I'd also relax the conditions and permit the installation of other future versions.

If the maintainers agree with these changes, please release a new minor version on PyPI at your earliest convenience.

[cianmcgrath]

I'm unsure why there's a pin to the specific version

The pin was introduced as there have been instances where new releases of cryptography (e.g. 40.0.0, 43.0.0) caused the cloudvision library to unable to be used without downgrading the cryptography library version until the library was updated. 43.0.0 for example moved a bunch of modules into a decrepit module, e.g. TripleDES cipher was moved to cryptography.hazmat.decrepit. Since those breakages there has been strong internal pushback to relaxing the requirement to only a lower bounds to prevent similar from occurring again. However, I'll bring this up with the team again.

but that effectively prevents us from upgrading to the latest cryptography release that resolves the security issues.

I'm somewhat confused on this statement as #43 from dependabot updated the cryptography dependency such that the security issue is addressed?
For the moment while I hear back from the internal team on this proposal, I'll make a new release with the current pinned version which dependabot made (and as far as I understand should resolve the cryptography security issues), and publish it to pypi.

[mirceaulinic]

Hey @cianmcgrath - thanks for looking into this quickly.

I'm somewhat confused on this statement as #43 from dependabot updated the cryptography dependency such that the security issue is addressed?

You're correct, my bad - I wanted to condense multiple things in one statement, but didn't end up being clear. Indeed, cryptography release 48.0.1 is the one that resolved the security issue. That said, I see the the latest release available on PyPI, v1.30.1 still requires crypto 46.0.7 https://github.com/aristanetworks/cloudvision-python/blob/v1.30.1/requirements.txt so would be fantastic if you could release a new minor version soon.

My patch for 49.0.0 is just to be more future proof for future crypto releases, and let the user figure out the necessary dependencies in their environment. Otherwise, you'd need to release a new cloudvision version with every Dependabot update, which would probably not be feasible.

[cianmcgrath]

Thanks for the clarification.

My patch for 49.0.0 is just to be more future proof for future crypto releases, and let the user figure out the necessary dependencies in their environment.

This issue has indeed been brought up before, and adds a fair bit of overhead on the maintenance of the library given it needs to be updated rather than just allowing others to manage their env deps.
Hopefully we can relax this, we're discussing how we can manage this better in our internal environs to allow for this in the library currently.
cc @gingerbus

[cianmcgrath]

1.30.2 should be out now with updated requirements. I'll update here when there's a better consensus internally on the relaxing of the pinned version.

[mirceaulinic]

Sounds good - thank you for the release!

[glennmatthews]

Would be desirable to update to allow v50, due to GHSA-g6cj-pr64-35w5

[mirceaulinic]

I'll update here when there's a better consensus internally on the relaxing of the pinned version.

@cianmcgrath was there any outcome following that discussion? It seems like we're prone to bumping into this with every security release... Anyway, I see the main branch was updated, so could you please release a new version on PyPI? Thank you!

[cianmcgrath]

was there any outcome following that discussion?

There are concerns about a new cryptography library or the like coming out and breaking support which have stalled these discussions. Still pushing for a resolution here given that from a maintenance perspective it alleviates a lot of work if we're not pinning.

Just waiting on some internal reviews before I can publish the latest version on pypi