False positive: GHSA-537c-gmf6-5ccf matched against RPM-installed python3-cryptography

Vulnerability ID: GHSA-537c-gmf6-5ccf (CVE-2026-45447)

Package URL or steps to reproduce:

grype pkg:rpm/sles/[email protected]?arch=x86_64&distro=sles-15

Alternatively, scan any SLES-based container image that includes python3-cryptography-3.3.2 installed via zypper:

dockerfile FROM registry.suse.com/suse/sle15:latest RUN zypper install -y python3-requests

bash grype docker:$(docker build -q .)

Grype command used: bash grype dir:/path/to/image-rootfs

No custom configuration (default .grype.yaml).

Anything else we need to know?:

This is a false positive. GHSA-537c-gmf6-5ccf applies exclusively to PyPI wheels of cryptography that bundle a statically-linked OpenSSL. The advisory explicitly states :

│ "Only users installing from wheels built by the cryptography project (i.e., those distributed on PyPI) need to update their cryptography versions."

Ref: https://github.com/advisories/GHSA-537c-gmf6-5ccf

The SLES RPM python3-cryptography-3.3.2 does not bundle OpenSSL. It dynamically links against the system-provided libopenssl1_1, which is independently maintained and patched by SUSE (fix for CVE-2026-45447 delivered via libopenssl1_1 >= 1.1.1w-150700.11.22.1).

Evidence that this is RPM-installed (not pip):

• Package path: usr/lib64/python3.6/site-packages/cryptography-3.3.2-py3.6.egg-info/PKG-INFO
• /usr/lib64/ is an RPM-managed path (pip installs to /usr/local/lib/ or a virtualenv)
• Package name is python3-cryptography (RPM naming), not cryptography (PyPI naming)
• Installed via zypper install python3-requests as an RPM dependency

Grype should not match PyPI-ecosystem advisories against OS-packaged Python libraries that do not bundle the affected component.

Environment:

• Output of grype version: v0.115.0
• OS (e.g: cat /etc/os-release or similar): SUSE Linux Enterprise Server 15