A resource exhaustion denial of service attack can be formed against python-cryptography versions 42.0.0 through 48.0.0 due to exponential blowup when resolving invalid certificate chains with duplicate self-signed certificates. This vulnerability can impact system availability, emphasizing the need for defenders to verify exposure and prioritize upgrading to version 49.0.0 or later. The issue arises from [truncated]
The cryptography package has an incomplete DNS name constraint enforcement on peer names. This issue allows a peer named bar.example.com to validate against a wildcard leaf certificate for *.example.com, even if the leaf's parent certificate contains an excluded subtree constraint for bar.example.com. The issue has been patched in version 46.0.6. Defenders should assess exposure and prioritize remediation [truncated]
