Cryptography Package S360 Security Vulnerability

[ronitshaw1993]

The cryptography package installed by Azure CLI is getting flagged for security vulnerabilities.

Any leads on when the next release is scheduled with the latest/above fix?

This is similar to the earlier issue I filed: #25682
Do I need to apply a similar fix here? Would do so if the next release is a little far ahead or the next release wouldn't contain the fix

[azure-client-tools-bot-prd]

Hi @ronitshaw1993,
Since the current milestone time is less than 7 days, this issue will be resolved in the next milestone.

[yonzhan]

@bebound for awareness

[bebound]

Cryptography is reverted to 38.0.4. Please see the explanation in #25690
Before updating cryptography, we need to use 64bit Python on Windows, which may take some time.

You can update build-in package with PYTHONPATH="/lib64/az/lib/python3.9/site-packages" python3.9 -m pip install -U xxxx

[ronitshaw1993]

So updating Cryptography using the above method when building a container out of a Mariner-based base image should be fine correct?

[bebound]

Yes.