GHSA-5cpq-8wj7-hf2v: 
Python vulnerability analysis and mitigation

The vulnerability affects the cryptography Python package (versions 0.5 through 40.0.2) which includes statically linked copies of OpenSSL. The issue was disclosed on May 31, 2023, and relates to vulnerable versions of OpenSSL included in the cryptography wheels distributed on PyPI (GitHub Advisory).

The vulnerability is tracked as GHSA-5cpq-8wj7-hf2v and CVE-2023-2650. The issue specifically affects the OpenSSL versions that are statically linked in the cryptography package wheels. The vulnerability is rated as Low severity (GitHub Advisory).

The impact is limited to users who installed cryptography from wheels built by the cryptography project and distributed on PyPI. Users building from source are not affected by this specific vulnerability as they manage their own OpenSSL versions (GitHub Advisory).

The vulnerability has been patched in cryptography version 41.0.0. Users are advised to upgrade to this version or later to receive the fixed OpenSSL version. For users building from source, they need to ensure they are using an up-to-date version of OpenSSL (GitHub Advisory, Cryptography Changelog).