p PatchFirst

CVE-2023-49083

CVE-2023-49083 · cryptography vulnerable to NULL-dereference when loading PKCS7 certificates

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling `load_pem_pkcs7_certificates` or `load_der_pkcs7_certificates` could lead to a NULL-pointer dereference and segfault. Exploitation of this vulnerability poses a serious risk of Denial of Service (DoS) for any application attempting to deserialize a PKCS7 blob/certificate. The consequences extend to potential disruptions in system availability and stability. This vulnerability has been patched in version 41.0.6.

CVSS 5.9 · Media · EPSS 1,0% · Corrección disponible

Publicación
Actualización

Pila tecnológica: system · python

Productos y versiones afectados

  • cryptography

    Versiones
    • >= 3.1, < 41.0.6: Afectada

    Sin corrección publicada

  • python-cryptography Debian:12

    Versiones
    • 38.0.4-3
    Intervalos de versiones afectados
    • ECOSYSTEM: < 38.0.4-3+deb12u1

    Actualiza a 38.0.4-3+deb12u1

  • python-cryptography Debian:13

    Intervalos de versiones afectados
    • ECOSYSTEM: < 41.0.7-1

    Actualiza a 41.0.7-1

  • python-cryptography Debian:14

    Intervalos de versiones afectados
    • ECOSYSTEM: < 41.0.7-1

    Actualiza a 41.0.7-1

  • cryptography PyPI

    Versiones
    • 3.1
    • 3.1.1
    • 3.2
    • 3.2.1
    • 3.3
    • 3.3.1
    • 3.3.2
    • 3.4
    • 3.4.1
    • 3.4.2
    • 3.4.3
    • 3.4.4
    • 3.4.5
    • 3.4.6
    • 3.4.7
    • 3.4.8
    • 35.0.0
    • 36.0.0
    • 36.0.1
    • 36.0.2
    • 37.0.0
    • 37.0.1
    • 37.0.2
    • 37.0.3
    • 37.0.4
    • 38.0.0
    • 38.0.1
    • 38.0.2
    • 38.0.3
    • 38.0.4
    • 39.0.0
    • 39.0.1
    • 39.0.2
    • 40.0.0
    • 40.0.1
    • 40.0.2
    • 41.0.0
    • 41.0.1
    • 41.0.2
    • 41.0.3
    • 41.0.4
    • 41.0.5
    Intervalos de versiones afectados
    • ECOSYSTEM: ≥ 3.1, < 41.0.6

    Actualiza a 41.0.6

  • cryptography PyPI

    Versiones
    • 3.1
    • 3.1.1
    • 3.2
    • 3.2.1
    • 3.3
    • 3.3.1
    • 3.3.2
    • 3.4
    • 3.4.1
    • 3.4.2
    • 3.4.3
    • 3.4.4
    • 3.4.5
    • 3.4.6
    • 3.4.7
    • 3.4.8
    • 35.0.0
    • 36.0.0
    • 36.0.1
    • 36.0.2
    • 37.0.0
    • 37.0.1
    • 37.0.2
    • 37.0.3
    • 37.0.4
    • 38.0.0
    • 38.0.1
    • 38.0.2
    • 38.0.3
    • 38.0.4
    • 39.0.0
    • 39.0.1
    • 39.0.2
    • 40.0.0
    • 40.0.1
    • 40.0.2
    • 41.0.0
    • 41.0.1
    • 41.0.2
    • 41.0.3
    • 41.0.4
    • 41.0.5
    Intervalos de versiones afectados
    • GIT: < f09c261ca10a31fe41b1262306db7f8f1da0e48a
    • ECOSYSTEM: ≥ 3.1, < 41.0.6

    Actualiza a 41.0.6

  • python-cryptography Ubuntu:22.04:LTS

    Versiones
    • 3.3.2-1
    • 3.3.2-1build1
    • 3.4.8-1
    • 3.4.8-1ubuntu1
    • 3.4.8-1ubuntu2
    Intervalos de versiones afectados
    • ECOSYSTEM: < 3.4.8-1ubuntu2.1

    Actualiza a 3.4.8-1ubuntu2.1

Fuentes originales

Comprueba tu servidor →