Skip to content

🛡️ Sentinel: [MEDIUM] Fix vulnerable dependency range for cryptography #7

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
kingkillery wants to merge 1 commit into
base: main
Choose a base branch
from
Draft

🛡️ Sentinel: [MEDIUM] Fix vulnerable dependency range for cryptography #7

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions .jules/sentinel.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
## 2025-04-07 - Vulnerable Dependency Range

@coderabbitai coderabbitai Bot Apr 7, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Fix journal entry date to match PR timeline.

The heading date appears off by one year versus this PR creation date (2026-04-07).

🛠️ Suggested doc fix 
-## 2025-04-07 - Vulnerable Dependency Range
+## 2026-04-07 - Vulnerable Dependency Range
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
## 2025-04-07 - Vulnerable Dependency Range
## 2026-04-07 - Vulnerable Dependency Range
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.jules/sentinel.md at line 1, Update the journal heading "## 2025-04-07 -
Vulnerable Dependency Range" to the correct PR timeline date by changing it to
"## 2026-04-07 - Vulnerable Dependency Range" so the sentinel entry matches the
PR creation date; locate and modify that exact heading text in
.jules/sentinel.md.

**Vulnerability:** The `pyproject.toml` configuration allowed `cryptography>=3.1`, which includes versions with known critical vulnerabilities (like CVE-2023-23931 and CVE-2020-25659).
**Learning:** Overly broad dependency ranges for security-critical packages like `cryptography` can accidentally introduce vulnerabilities if an older, affected version satisfies the constraint. It's safer to have tighter bounds or specifically exclude vulnerable major versions.
**Prevention:** Establish a process to regularly review and update minimum required versions for dependencies that deal with encryption, authentication, or other sensitive operations. Use a minimum version that is known to be patched against historical CVEs.
2 changes: 1 addition & 1 deletion pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ readme = "README.md"
requires-python = ">=3.10"
urls = { Homepage = "https://github.com/jbarrow/commonforms" }
dependencies = [
"cryptography>=3.1",
"cryptography>=42.0.0",

@coderabbitai coderabbitai Bot Apr 7, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🌐 Web query:

`Verify from official sources:

  1. Does cryptography 42.x support Python >=3.10?
  2. Are there any known CVEs affecting cryptography 42.0.0 specifically?
  3. Do common ecosystem packages (e.g., pyOpenSSL) have compatibility notes requiring a newer cryptography minimum than 42.0.0?`

💡 Result:

  1. Yes. cryptography 42.x supports Python ≥3.10 (it declares Requires: Python >=3.7 and ships wheels for Python 3.10). [1]

  2. Yes. At least these CVEs affect cryptography 42.0.0:

    • CVE-2024-26130 — affects cryptography >=38.0.0 and <42.0.4, so 42.0.0 is affected. [2]
    • CVE-2024-12797 — affects cryptography >=42.0.0 and <44.0.1 (specifically: vulnerable OpenSSL statically linked into the project’s wheels), so 42.0.0 is affected. [3]

  3. Yes. Some common ecosystem packages require newer cryptography than 42.0.0:

    • pyOpenSSL: since 25.2.0, minimum cryptography is 45.0.7 (and 26.0.0 requires 46.0.0). [4]
    • certbot 5.4.0: requires cryptography>=43.0.0. [5]

Sources:
[1] PyPI cryptography 42.0.0 metadata (Python requirement / wheels) (pypi.org)
[2] NVD entry for CVE-2024-26130 (affected version range includes 42.0.0) (nvd.nist.gov)
[3] GitHub Advisory Database: GHSA-79v4-65xg-pq4g / CVE-2024-12797 (affected cryptography range starts at 42.0.0) (github.com)
[4] PyPI pyOpenSSL release metadata showing raised minimum cryptography (25.2.0+) (pypi.org)
[5] PyPI JSON for certbot 5.4.0 (requires_dist includes cryptography>=43.0.0) (pypi.org)

Citations:

Consider raising cryptography minimum version higher than 42.0.0.

Version 42.0.0 itself is affected by at least two known CVEs:

Additionally, common ecosystem packages already require newer versions:

  • pyOpenSSL ≥25.2.0 requires cryptography≥45.0.7
  • certbot 5.4.0 requires cryptography≥43.0.0

Pinning to 42.0.0 does not prevent resolution to vulnerable releases and may cause compatibility friction with dependencies.

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@pyproject.toml` at line 13, The pyproject.toml currently allows
"cryptography>=42.0.0", which includes known vulnerable releases; update the
dependency to a safer minimum (for example "cryptography>=45.0.7" to satisfy
pyOpenSSL and avoid CVEs) by editing the cryptography spec in pyproject.toml and
then regenerate the lockfile / reinstall dependencies (e.g., run your
lock/update command) so the new minimum is enforced; look for the literal
"cryptography>=42.0.0" string to change.

"formalpdf==0.1.6",
"huggingface-hub>=0.35.3",
"onnx>=1.19.1",
Expand Down