PYSEC-2024-225

See a problem?

Import Source

https://github.com/pypa/advisory-database/blob/main/vulns/cryptography/PYSEC-2024-225.yaml

JSON Data

https://api.test.osv.dev/v1/vulns/PYSEC-2024-225

Aliases

Published

2024-02-21T17:15:09Z

Modified

2026-06-10T17:14:12.444619436Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

[none]

Details

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Starting in version 38.0.0 and prior to version 42.0.4, if pkcs12.serialize_key_and_certificates is called with both a certificate whose public key did not match the provided private key and an encryption_algorithm with hmac_hash set (via PrivateFormat.PKCS12.encryption_builder().hmac_hash(...), then a NULL pointer dereference would occur, crashing the Python process. This has been resolved in version 42.0.4, the first version in which a ValueError is properly raised.

References

Affected packages

PyPI / cryptography

Package

Name: cryptography; View open source insights on deps.dev
Purl: pkg:pypi/cryptography

Affected ranges

Type: GIT
Repo: https://github.com/pyca/cryptography
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

97d231672763cdb5959a3b191e692a362f1b9e55

Type: ECOSYSTEM
Events: Introduced

38.0.0

Fixed

42.0.4

Affected versions

0.*

0.1

0.2

0.3

0.4

0.5

0.5.1

0.6

0.7

0.8

0.9

1.*

1.0

1.1

1.2

1.3

1.4

1.5

1.6

1.7

1.8

1.9

2.*

2.0

2.1

2.2

2.3

2.4

2.4.1

2.5

2.6

2.6.1

2.7

2.8

2.9

3.*

3.0

3.1

3.2

3.3

3.4

35.*

35.0.0

36.*

36.0.0

37.*

37.0.0

38.*

38.0.0

38.0.1

38.0.2

38.0.3

38.0.4

39.*

39.0.0

39.0.1

39.0.2

40.*

40.0.0

40.0.1

40.0.2

41.*

41.0.0

41.0.1

41.0.2

41.0.3

41.0.4

41.0.5

41.0.6

41.0.7

42.*

42.0.0

42.0.1

42.0.2

42.0.3

Database specific

source

"https://github.com/pypa/advisory-database/blob/main/vulns/cryptography/PYSEC-2024-225.yaml"