p PatchFirst

CVE-2023-49083

CVE-2023-49083 · cryptography vulnerable to NULL-dereference when loading PKCS7 certificates

This page contains facts from public vulnerability sources. Check the original advisory before updating.

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling `load_pem_pkcs7_certificates` or `load_der_pkcs7_certificates` could lead to a NULL-pointer dereference and segfault. Exploitation of this vulnerability poses a serious risk of Denial of Service (DoS) for any application attempting to deserialize a PKCS7 blob/certificate. The consequences extend to potential disruptions in system availability and stability. This vulnerability has been patched in version 41.0.6.

CVSS 5.9 · Medium · EPSS 1.0% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • cryptography

    Versions
    • >= 3.1, < 41.0.6: Affected

    No fix published

  • python-cryptography Debian:12

    Versions
    • 38.0.4-3
    Affected ranges
    • ECOSYSTEM: < 38.0.4-3+deb12u1

    Update to 38.0.4-3+deb12u1

  • python-cryptography Debian:13

    Affected ranges
    • ECOSYSTEM: < 41.0.7-1

    Update to 41.0.7-1

  • python-cryptography Debian:14

    Affected ranges
    • ECOSYSTEM: < 41.0.7-1

    Update to 41.0.7-1

  • cryptography PyPI

    Versions
    • 3.1
    • 3.1.1
    • 3.2
    • 3.2.1
    • 3.3
    • 3.3.1
    • 3.3.2
    • 3.4
    • 3.4.1
    • 3.4.2
    • 3.4.3
    • 3.4.4
    • 3.4.5
    • 3.4.6
    • 3.4.7
    • 3.4.8
    • 35.0.0
    • 36.0.0
    • 36.0.1
    • 36.0.2
    • 37.0.0
    • 37.0.1
    • 37.0.2
    • 37.0.3
    • 37.0.4
    • 38.0.0
    • 38.0.1
    • 38.0.2
    • 38.0.3
    • 38.0.4
    • 39.0.0
    • 39.0.1
    • 39.0.2
    • 40.0.0
    • 40.0.1
    • 40.0.2
    • 41.0.0
    • 41.0.1
    • 41.0.2
    • 41.0.3
    • 41.0.4
    • 41.0.5
    Affected ranges
    • ECOSYSTEM: ≥ 3.1, < 41.0.6

    Update to 41.0.6

  • cryptography PyPI

    Versions
    • 3.1
    • 3.1.1
    • 3.2
    • 3.2.1
    • 3.3
    • 3.3.1
    • 3.3.2
    • 3.4
    • 3.4.1
    • 3.4.2
    • 3.4.3
    • 3.4.4
    • 3.4.5
    • 3.4.6
    • 3.4.7
    • 3.4.8
    • 35.0.0
    • 36.0.0
    • 36.0.1
    • 36.0.2
    • 37.0.0
    • 37.0.1
    • 37.0.2
    • 37.0.3
    • 37.0.4
    • 38.0.0
    • 38.0.1
    • 38.0.2
    • 38.0.3
    • 38.0.4
    • 39.0.0
    • 39.0.1
    • 39.0.2
    • 40.0.0
    • 40.0.1
    • 40.0.2
    • 41.0.0
    • 41.0.1
    • 41.0.2
    • 41.0.3
    • 41.0.4
    • 41.0.5
    Affected ranges
    • GIT: < f09c261ca10a31fe41b1262306db7f8f1da0e48a
    • ECOSYSTEM: ≥ 3.1, < 41.0.6

    Update to 41.0.6

  • python-cryptography Ubuntu:22.04:LTS

    Versions
    • 3.3.2-1
    • 3.3.2-1build1
    • 3.4.8-1
    • 3.4.8-1ubuntu1
    • 3.4.8-1ubuntu2
    Affected ranges
    • ECOSYSTEM: < 3.4.8-1ubuntu2.1

    Update to 3.4.8-1ubuntu2.1

Original sources

Check your server →