Most recent entries from all

ALSA-2024:2337 — Moderate: python3.11-cryptography security update

Affected: AlmaLinux:9: python3.11-cryptography

The python-cryptography packages contain a Python Cryptographic Authority's (PyCA's) cryptography library, which provides cryptographic primitives and recipes to Python developers.

Security Fix(es):

* python-cryptography: NULL-dereference when loading PKCS7 certificates (CVE-2023-49083)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

bdu:2024-02534

BELL-CVE-2023-49083

Affected: Alpaquita:23: py3-cryptography, Alpaquita:stream: py3-cryptography

BREW-azure-cli-CVE-2023-49083 — cryptography vulnerable to NULL-dereference when loading PKCS7 certificates

Affected: Homebrew: azure-cli

### Summary

Calling `load_pem_pkcs7_certificates` or `load_der_pkcs7_certificates` could lead to a NULL-pointer dereference and segfault.

### PoC Here is a Python code that triggers the issue: ```python from cryptography.hazmat.primitives.serialization.pkcs7 import load_der_pkcs7_certificates, load_pem_pkcs7_certificates

pem_p7 = b""" -----BEGIN PKCS7----- MAsGCSqGSIb3DQEHAg== -----END PKCS7----- """

der_p7 = b"\x30\x0B\x06\x09\x2A\x86\x48\x86\xF7\x0D\x01\x07\x02"

load_pem_pkcs7_certificates(pem_p7) load_der_pkcs7_certificates(der_p7) ```

### Impact Exploitation of this vulnerability poses a serious risk of Denial of Service (DoS) for any application attempting to deserialize a PKCS7 blob/certificate. The consequences extend to potential disruptions in system availability and stability.

certfr-2024-avi-0297 — De multiples vulnérabilités ont été découvertes dans Juniper. Certaines d'entre elles permettent à un attaquant de prov…

certfr-2024-avi-0297

EUVD-2026-264040

fkie_cve-2023-49083

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling `load_pem_pkcs7_certificates` or `load_der_pkcs7_certificates` could lead to a NULL-pointer dereference and segfault. Exploitation of this vulnerability poses a serious risk of Denial of Service (DoS) for any application attempting to deserialize a PKCS7 blob/certificate. The consequences extend to potential disruptions in system availability and stability. This vulnerability has been patched in version 41.0.6.

GHSA-jfhm-5ghh-2f97 — cryptography vulnerable to NULL-dereference when loading PKCS7 certificates

Affected: PyPI: cryptography

### Summary

Calling `load_pem_pkcs7_certificates` or `load_der_pkcs7_certificates` could lead to a NULL-pointer dereference and segfault.

### PoC Here is a Python code that triggers the issue: ```python from cryptography.hazmat.primitives.serialization.pkcs7 import load_der_pkcs7_certificates, load_pem_pkcs7_certificates

pem_p7 = b""" -----BEGIN PKCS7----- MAsGCSqGSIb3DQEHAg== -----END PKCS7----- """

der_p7 = b"\x30\x0B\x06\x09\x2A\x86\x48\x86\xF7\x0D\x01\x07\x02"

load_pem_pkcs7_certificates(pem_p7) load_der_pkcs7_certificates(der_p7) ```

gsd-2023-49083

msrc_CVE-2023-49083 — cryptography vulnerable to NULL-dereference when loading PKCS7 certificates

msrc_CVE-2023-49083

OESA-2023-1887 — python-cryptography security update

Affected: openEuler:20.03-LTS-SP1: python-cryptography, openEuler:20.03-LTS-SP3: python-cryptography, openEuler:22.03-LTS: python-cryptography, openEuler:22.03-LTS-SP1: python-cryptography, openEuler:22.03-LTS-SP2: python-cryptography

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Security Fix(es): cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling `load_pem_pkcs7_certificates` or `load_der_pkcs7_certificates` could lead to a NULL-pointer dereference and segfault. Exploitation of this vulnerability poses a serious risk of Denial of Service (DoS) for any application attempting to deserialize a PKCS7 blob/certificate. The consequences extend to potential disruptions in system availability and stability. This vulnerability has been patched in version 41.0.6.(CVE-2023-49083)

openSUSE-SU-2024:13472-1 — python310-cryptography-41.0.7-1.1 on GA media

python310-cryptography-41.0.7-1.1 on GA media

PYSEC-2023-254

Affected: PyPI: cryptography

RHSA-2024:10965 — Red Hat Security Advisory: python3.11-cryptography security update

python-cryptography: NULL-dereference when loading PKCS7 certificates

SUSE-SU-2023:4844-1 — Security update for python-cryptography

Security update for python-cryptography

UBUNTU-CVE-2023-49083

Affected: Ubuntu:22.04:LTS: python-cryptography

WID-SEC-W-2024-0869 — Oracle Communications: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Communications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.