CVE-2023-38325

CSIRTS triage

What

The cryptography package incorrectly handles SSH certificates with critical options, potentially allowing certificate validation bypass.

Who is affected

Python applications using the cryptography library for SSH certificate validation before version 41.0.2.

Urgency

High priority; affects SSH authentication security and may allow attackers to forge or misuse certificates.

Action

Update the cryptography package to version 41.0.2 or later immediately.

AI-assisted analysis generated from the source advisory — verify against the original.

Exploitation outlook

• Low exploitation risk0.73% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 52% of all EPSS-scored CVEs.

Advisory coverage (1)

• highCVE-2023-38325: The cryptography package before 41.0.2 for Python mishandles SSH certificates that have critic…msrc · 2026-08-06

External references

NVD record for CVE-2023-38325

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2023-38325 status](https://www.csirts.com/badge/CVE-2023-38325)](https://www.csirts.com/cve/CVE-2023-38325)