PYSEC-2023-254

See a problem?
Import Source
https://github.com/pypa/advisory-database/blob/main/vulns/cryptography/PYSEC-2023-254.yaml
JSON Data
https://api.osv.dev/v1/vulns/PYSEC-2023-254
Aliases
Published
2023-11-29T19:15:00Z
Modified
2024-09-11T06:13:40.243751Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling load_pem_pkcs7_certificates or load_der_pkcs7_certificates could lead to a NULL-pointer dereference and segfault. Exploitation of this vulnerability poses a serious risk of Denial of Service (DoS) for any application attempting to deserialize a PKCS7 blob/certificate. The consequences extend to potential disruptions in system availability and stability. This vulnerability has been patched in version 41.0.6.

References

Affected packages

PyPI / cryptography

Package

Affected ranges

Type
GIT
Repo
https://github.com/pyca/cryptography
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
Type
ECOSYSTEM
Events
Introduced
3.1
Fixed
41.0.6

Affected versions

3.*

3.1
3.1.1
3.2
3.2.1
3.3
3.3.1
3.3.2
3.4
3.4.1
3.4.2
3.4.3
3.4.4
3.4.5
3.4.6
3.4.7
3.4.8

35.*

35.0.0

36.*

36.0.0
36.0.1
36.0.2

37.*

37.0.0
37.0.1
37.0.2
37.0.3
37.0.4

38.*

38.0.0
38.0.1
38.0.2
38.0.3
38.0.4

39.*

39.0.0
39.0.1
39.0.2

40.*

40.0.0
40.0.1
40.0.2

41.*

41.0.0
41.0.1
41.0.2
41.0.3
41.0.4
41.0.5