diff -uNr a/bundled/gcp/google-cloud-sdk/lib/third_party/oauth2client/_pure_python_crypt.py b/bundled/gcp/google-cloud-sdk/lib/third_party/oauth2client/_pure_python_crypt.py

--- a/bundled/gcp/google-cloud-sdk/lib/third_party/oauth2client/_pure_python_crypt.py	1980-01-01 09:00:00.000000000 +0100

+++ b/bundled/gcp/google-cloud-sdk/lib/third_party/oauth2client/_pure_python_crypt.py	2019-04-04 11:56:00.292677044 +0200

@@ -19,8 +19,14 @@

 certificates.

 """

+from pyasn1.codec.der import decoder

 from pyasn1_modules import pem

-import rsa

+from pyasn1_modules.rfc2459 import Certificate

+from pyasn1_modules.rfc5208 import PrivateKeyInfo

+from cryptography.hazmat.primitives import serialization, hashes

+from cryptography.hazmat.primitives.asymmetric import padding

+from cryptography import x509

+from cryptography.hazmat.backends import default_backend

 import six

 from oauth2client import _helpers

@@ -40,7 +46,7 @@

                  '-----END RSA PRIVATE KEY-----')

 _PKCS8_MARKER = ('-----BEGIN PRIVATE KEY-----',

                  '-----END PRIVATE KEY-----')

-_PKCS8_SPEC = None

+_PKCS8_SPEC = PrivateKeyInfo()

 def _bit_list_to_bytes(bit_list):

@@ -67,7 +73,8 @@

     """

     def __init__(self, pubkey):

-        self._pubkey = pubkey

+        self._pubkey = serialization.load_pem_public_key(pubkey,

+            backend=default_backend())

     def verify(self, message, signature):

         """Verifies a message against a signature.

@@ -84,8 +91,9 @@

         """

         message = _helpers._to_bytes(message, encoding='utf-8')

         try:

-            return rsa.pkcs1.verify(message, signature, self._pubkey)

-        except (ValueError, rsa.pkcs1.VerificationError):

+            return self._pubkey.verify(signature, message, padding.PKCS1v15(),

+                hashes.SHA256())

+        except (ValueError, TypeError, InvalidSignature):

             return False

     @classmethod

@@ -109,19 +117,18 @@

         """

         key_pem = _helpers._to_bytes(key_pem)

         if is_x509_cert:

-            from pyasn1.codec.der import decoder

-            from pyasn1_modules import rfc2459

-

-            der = rsa.pem.load_pem(key_pem, 'CERTIFICATE')

-            asn1_cert, remaining = decoder.decode(der, asn1Spec=rfc2459.Certificate())

+            der = x509.load_pem_x509_certificate(pem_data, default_backend())

+            asn1_cert, remaining = decoder.decode(der, asn1Spec=Certificate())

             if remaining != b'':

                 raise ValueError('Unused bytes', remaining)

             cert_info = asn1_cert['tbsCertificate']['subjectPublicKeyInfo']

             key_bytes = _bit_list_to_bytes(cert_info['subjectPublicKey'])

-            pubkey = rsa.PublicKey.load_pkcs1(key_bytes, 'DER')

+            pubkey = serialization.load_der_public_key(decoded_key,

+                backend=default_backend())

         else:

-            pubkey = rsa.PublicKey.load_pkcs1(key_pem, 'PEM')

+            pubkey = serialization.load_pem_public_key(decoded_key,

+                backend=default_backend())

         return cls(pubkey)

@@ -134,6 +141,8 @@

     def __init__(self, pkey):

         self._key = pkey

+        self._pubkey = serialization.load_pem_private_key(pkey,

+            backend=default_backend())

     def sign(self, message):

         """Signs a message.

@@ -145,7 +154,7 @@

             string, The signature of the message for the given key.

         """

         message = _helpers._to_bytes(message, encoding='utf-8')

-        return rsa.pkcs1.sign(message, self._key, 'SHA-256')

+        return self._key.sign(message, padding.PKCS1v15(), hashes.SHA256())

     @classmethod

     def from_string(cls, key, password='notasecret'):

@@ -163,27 +172,24 @@

             ValueError if the key cannot be parsed as PKCS#1 or PKCS#8 in

             PEM format.

         """

-        global _PKCS8_SPEC

         key = _helpers._from_bytes(key)  # pem expects str in Py3

         marker_id, key_bytes = pem.readPemBlocksFromFile(

             six.StringIO(key), _PKCS1_MARKER, _PKCS8_MARKER)

         if marker_id == 0:

-            pkey = rsa.key.PrivateKey.load_pkcs1(key_bytes,

-                                                 format='DER')

-        elif marker_id == 1:

-            from pyasn1.codec.der import decoder

-            from pyasn1_modules import rfc5208

+            pkey = serialization.load_der_private_key(

+                key_bytes, password=None,

+                backend=default_backend())

-            if _PKCS8_SPEC is None:

-              _PKCS8_SPEC = rfc5208.PrivateKeyInfo()

+        elif marker_id == 1:

             key_info, remaining = decoder.decode(

                 key_bytes, asn1Spec=_PKCS8_SPEC)

             if remaining != b'':

                 raise ValueError('Unused bytes', remaining)

             pkey_info = key_info.getComponentByName('privateKey')

-            pkey = rsa.key.PrivateKey.load_pkcs1(pkey_info.asOctets(),

-                                                 format='DER')

+            pkey = serialization.load_der_private_key(

+                pkey_info.asOctets(), password=None,

+                backend=default_backend())

         else:

             raise ValueError('No key could be detected.')