CVE-2023-49083

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-49083
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-49083.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2023-49083
Aliases
Downstream
AZL (2)
BELL (1)
CGA (6)
CLSA (2)
DEBIAN (1)
MGASA (1)
OESA (1)
openSUSE (2)
RHSA (14)
RLSA (4)
ROOT (1)
SUSE (5)
UBUNTU (1)
Related
ALSA (4)
openSUSE (2)
SUSE (5)
Published
2023-11-29T18:50:24Z
Modified
2026-10-16T02:51:58Z
Severity
  • 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
cryptography vulnerable to NULL-dereference when loading PKCS7 certificates
Details

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling load_pem_pkcs7_certificates or load_der_pkcs7_certificates could lead to a NULL-pointer dereference and segfault. Exploitation of this vulnerability poses a serious risk of Denial of Service (DoS) for any application attempting to deserialize a PKCS7 blob/certificate. The consequences extend to potential disruptions in system availability and stability. This vulnerability has been patched in version 41.0.6.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-476"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/49xxx/CVE-2023-49083.json"
}
References

Affected packages

Git / github.com/pyca/cryptography

Affected ranges

Type
GIT
Repo
https://github.com/pyca/cryptography
Events
Introduced
ba2c0e5e3e4fb242b80474d2ff7368c91e7ebeaf
Fixed
f09c261ca10a31fe41b1262306db7f8f1da0e48a
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "3.1"
                },
                {
                    "fixed": "41.0.6"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "f09c261ca10a31fe41b1262306db7f8f1da0e48a"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "cpe": "cpe:2.3:a:cryptography.io:cryptography:*:*:*:*:*:python:*:*",
            "range": [
                {
                    "introduced": "3.1"
                },
                {
                    "fixed": "41.0.6"
                }
            ],
            "source": "CPE_RANGE"
        }
    ]
}

Affected versions

3.*
3.1
3.2
3.3
3.4
35.*
35.0.0
36.*
36.0.0
37.*
37.0.0
38.*
38.0.0
39.*
39.0.0
40.*
40.0.0
41.*
41.0.0
41.0.1
41.0.2
41.0.3
41.0.4
41.0.5

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-49083.json"