CVE-2023-49083

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling load_pem_pkcs7_certificates or load_der_pkcs7_certificates could lead to a NULL-pointer dereference and segfault. Exploitation of this vulnerability poses a serious risk of Denial of Service (DoS) for any application attempting to deserialize a PKCS7 blob/certificate. The consequences extend to potential disruptions in system availability and stability. This vulnerability has been patched in version 41.0.6.

Database specific

{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/49xxx/CVE-2023-49083.json",
    "cwe_ids": [
        "CWE-476"
    ]
}

References

Affected packages

Git / github.com/pyca/cryptography

Affected ranges

Type: GIT
Repo: https://github.com/pyca/cryptography
Events: Introduced

ba2c0e5e3e4fb242b80474d2ff7368c91e7ebeaf

Fixed

f09c261ca10a31fe41b1262306db7f8f1da0e48a

Affected versions

3.*

3.1

3.2

3.3

3.4

35.*

35.0.0

36.*

36.0.0

37.*

37.0.0

38.*

38.0.0

39.*

39.0.0

40.*

40.0.0

41.*

41.0.0

41.0.1

41.0.2

41.0.3

41.0.4

41.0.5