CVE-2023-49083

29.11.2023, 19:15

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling `load_pem_pkcs7_certificates` or `load_der_pkcs7_certificates` could lead to a NULL-pointer dereference and segfault. Exploitation of this vulnerability poses a serious risk of Denial of Service (DoS) for any application attempting to deserialize a PKCS7 blob/certificate. The consequences extend to potential disruptions in system availability and stability. This vulnerability has been patched in version 41.0.6.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	5.9 MEDIUM	NETWORK	HIGH	NONE	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 79%

Affected Products (NVD)

Vendor	Product	Version
cryptography.io	cryptography	3.1 ≤ 𝑥 < 41.0.6

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

python-cryptography

bookworm	38.0.4-3+deb12u1 fixed
bookworm (security)	vulnerable
bullseye	vulnerable
bullseye (security)	3.3.2-1+deb11u1 fixed
buster	not-affected
sid	43.0.0-1 fixed
trixie	43.0.0-1 fixed

Ubuntu Releases

Ubuntu Product

Codename

python-cryptography

bionic	not-affected
focal	not-affected
jammy	Fixed 3.4.8-1ubuntu2.1 released
lunar	Fixed 38.0.4-2ubuntu0.1 released
mantic	Fixed 38.0.4-4ubuntu0.23.10.1 released
trusty	ignored
xenial	not-affected

openSUSE / SLES Releases

openSUSE Product

Release

python2-cryptography

suse enterprise sap 15 SP1	3.3.2-150100.7.18.1 fixed
suse enterprise server 15 SP1	3.3.2-150100.7.18.1 fixed

python3-cryptography

suse enterprise sap 15 SP1	3.3.2-150100.7.18.1 fixed
suse enterprise server 15 SP1	3.3.2-150100.7.18.1 fixed
suse enterprise server 15 SP4	3.3.2-150400.23.1 fixed

python311-cryptography

suse enterprise server 15 SP4

41.0.3-150400.16.12.1

fixed