`safety` requires `crypography>=39.0.0` which hasn't been released yet

• safety version: 1.10.3
• Python version: 3.10.2
• Operating System: MacOS 11.7

Description

Hello 👋

safety currently requires cryptography>=39.0.0 for its checks to pass (see screenshot), citing the below reason, with ID 51159:

Cryptography 39.0.0 drops support for C library “LibreSSL” < 3.4, as these versions are not receiving security support anymore.

However, it looks like version 39.0.0 of cryptography is under development and hasn’t been released yet.

As far as I can see, the only way around this for now is to ask safety to ignore its check on cryptography.

There’s a comment on commit https://github.com/pyupio/safety-db/commit/e582a03665fde14b58dd247b5d33aa4c0f0832e5 about it here.

Thanks 🙏

What I Did

Ran the following:

safety check --full-report --file=requirements.txt

[alex]

Hi, I’m one of the pyca/cryptography primary maintainers.

This isn’t a security issue in pyca/cryptography in the first instance. It’s removing support for interoperating with older LibresSSL versions. To a certain extent using old unsupported libressl is a security issue, but that’s fixed by upgrading libressl, not by upgrading cryptography.

I’d strongly encourage the safety maintainers to consult with the pyca/cryptography maintainers when creating vulnerability reports for us. We always request CVEs when fixing vulnerabilities.

[yeisonvargasf]

Hi everyone. For now, we have decided to remove the vulnerability and update our databases to reflect this. Even though this vulnerability is valid for a subset of users, given that the maintainers report that the vast majority of users are unaffected we can remove it for now. Thanks for bringing this up, and for everyone’s patience. Our security team will look at this again soon; if we consider it worth publishing, we will first contact maintainers to discuss it before sending it to the public. (I’m closing this thread too)