Security Fix Released for Python Cryptography Package in Fedora 44

Linuxsecurity

Security Fix Released for Python Cryptography Package in Fedora 44

First seen 30 Mar 2026, 07:30 UTC • •45.6

Article Content

1 / 3

Browse articles

ThreatCluster •March 31, 2026 at 07:29 UTC

•Fedora 44 released python-cryptography version 46.0.6 to fix CVE-2026-34073.
•The vulnerability allowed improper verification of peer names with wildcard DNS SANs.
•Users are encouraged to update their systems using the 'dnf' package manager.

Fedora has released an update for the python-cryptography package, version 46.0.6, addressing a security vulnerability identified as CVE-2026-34073. The issue involved a bug where name constraints were not applied to peer names during verification when the leaf certificate contained a wildcard DNS Subject Alternative Name (SAN). This vulnerability does not affect ordinary X.509 topologies, including those used by the Web PKI. The update was made available on March 26, 2026, and users are advised to upgrade their systems using the 'dnf' package manager. The vulnerability was reported by Oleh Konko (1seal). The update is crucial for developers using this package to ensure secure cryptographic practices.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 193d ago How this analysis works

Timeline

2026-03-26

Update to python-cryptography version 46.0.6 released

2026-03-30

Articles published detailing the security fix

More articles in this cluster (2)

Threat Graph

2 entities, 1 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Organization (1)

Fedora

Vulnerability (1)

CVE-2026-34073

Relationships

CVE-2026-34073 related to Fedora

Following this threat?

Track Fedora and CVE-2026-34073 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

CVE-2015-3306 Exploited in ProFTPD FTP Servers CVE-2015-3306, a vulnerability in ProFTPD 1.3.5, allows remote attackers to read and write arbitrary files using the SITE CPFR and SITE CPTO commands. This exploit can lead to unauthorized access and potential remote code execution, as the commands are executed with the privileges of the ProFTPD service. Active…

CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch five critical vulnerabilities by October 11, 2026, following exploitation by the China-linked hacking group Flax Typhoon. The vulnerabilities, added to CISA's Known Exploited Vulnerabilities (KEV) catalog, include…