[8.19] fix(deps): bump pyOpenSSL to 26.3.0 and msal to 1.37.0 for CVE-2026-34180 (#4270) - #4273
Merged
Merged
Conversation
…4180 (#4270) Part of elastic/security#12757 (CVE-2026-34180) ## Description Proactive dependency bump to remediate **CVE-2026-34180**, a heap buffer over-read in OpenSSL's ASN.1 decoder (`d2i_*` functions) when parsing a crafted DER structure with a primitive element exceeding 2 GB on 64-bit Unix-like platforms (CWE-125, CVSS 7.5 HIGH — DoS / out-of-bounds memory read). Fixed in OpenSSL 4.0.1 / 3.6.3 / 3.5.7 / 3.4.6 / 3.0.21. In this codebase the vulnerable OpenSSL is statically **bundled inside the `cryptography` wheel** (a transitive dependency). The resolved `cryptography` 46.0.7 wheel ships **OpenSSL 3.5.6**, which is affected (`3.5.0 <= x < 3.5.7`). `cryptography` was capped below the fix by two parents: - `pyOpenSSL==26.0.0` → `cryptography<47` - `msal==1.32.3` → `cryptography<47` This PR bumps both parents so the resolver can pull a fixed `cryptography`: - `pyOpenSSL` **26.0.0 → 26.3.0** (requires `cryptography>=49.0.0`) - `msal` **1.32.3 → 1.37.0** (allows `cryptography<51`) Result: `cryptography` resolves to **49.0.0**, whose wheels ship **OpenSSL 4.0.1** (fixed). `NOTICE.txt` regenerated accordingly. Bundled OpenSSL confirmed via `cryptography`'s backend: **before 3.5.6 → after 4.0.1**. ### Affected assessment **Not Affected.** The vulnerable `d2i_*` decoders are present, but exploitation requires an attacker to feed a crafted DER ASN.1 structure with a >2 GB primitive element into the decoder. Connectors only initiates outbound connections to operator-configured third-party data sources; it is not a public-facing service accepting arbitrary attacker-controlled certificates/DER blobs, so the input to the affected code path cannot be attacker-controlled. Bumped proactively regardless. ## Scanner A/B (`CVE-2026-34180`) | Tool | Before | After | |------|--------|-------| | pip-audit | n/a | n/a | | Trivy | n/a | n/a | | Snyk | reported | clear | Snyk (which tracks the OpenSSL bundled in the `cryptography` wheel) reported the CVE on the pre-fix set and cleared it after the bump. pip-audit and Trivy do not map this OpenSSL CVE to the PyPI package, so they were inconclusive (not a fail). ## Checklists #### Pre-Review Checklist - [x] this PR does NOT contain credentials of any kind - [x] this PR has a meaningful title - [x] this PR has a thorough description - [x] Added a label for each target release version #### Changes Requiring Extra Attention - [x] Security-related changes (bundled OpenSSL via `cryptography`) ## Release Note Bump `pyOpenSSL` to 26.3.0 and `msal` to 1.37.0 to pull `cryptography` 49.0.0 (bundled OpenSSL 4.0.1), remediating CVE-2026-34180. Made with [Cursor](https://cursor.com) Co-authored-by: Cursor <cursoragent@cursor.com>
Jan-Kazlouski-elastic
requested review from
a team,
artem-shelkovnikov and
erikcurrin-elastic
July 24, 2026 15:58
erikcurrin-elastic
approved these changes
Jul 24, 2026
erikcurrin-elastic
approved these changes
Jul 24, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backports the following commits to 8.19:
Made with Cursor