Most recent entries from all

ALSA-2025:15608 — Important: python3.12-cryptography security update

Affected: AlmaLinux:9: python3.12-cryptography

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

* python-cryptography: NULL pointer dereference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override (CVE-2024-26130)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2024-03237

BELL-CVE-2024-26130

Affected: Alpaquita:23: py3-cryptography, Alpaquita:stream: py3-cryptography

BREW-azure-cli-CVE-2024-26130 — cryptography NULL pointer dereference with pkcs12.serialize_key_and_certificates when called with a non-matching certif…

Affected: Homebrew: azure-cli

If `pkcs12.serialize_key_and_certificates` is called with both:

1. A certificate whose public key did not match the provided private key 2. An `encryption_algorithm` with `hmac_hash` set (via `PrivateFormat.PKCS12.encryption_builder().hmac_hash(...)`

Then a NULL pointer dereference would occur, crashing the Python process.

This has been resolved, and now a `ValueError` is properly raised.

Patched in https://github.com/pyca/cryptography/pull/10423

certfr-2024-avi-0305 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre el…

certfr-2024-avi-0305

EUVD-2026-158618

fkie_cve-2024-26130

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Starting in version 38.0.0 and prior to version 42.0.4, if `pkcs12.serialize_key_and_certificates` is called with both a certificate whose public key did not match the provided private key and an `encryption_algorithm` with `hmac_hash` set (via `PrivateFormat.PKCS12.encryption_builder().hmac_hash(...)`, then a NULL pointer dereference would occur, crashing the Python process. This has been resolved in version 42.0.4, the first version in which a `ValueError` is properly raised.

GHSA-6vqw-3v5j-54x4 — cryptography NULL pointer dereference with pkcs12.serialize_key_and_certificates when called with a non-matching certif…

Affected: PyPI: cryptography

If `pkcs12.serialize_key_and_certificates` is called with both:

1. A certificate whose public key did not match the provided private key 2. An `encryption_algorithm` with `hmac_hash` set (via `PrivateFormat.PKCS12.encryption_builder().hmac_hash(...)`

Then a NULL pointer dereference would occur, crashing the Python process.

This has been resolved, and now a `ValueError` is properly raised.

Patched in https://github.com/pyca/cryptography/pull/10423

gsd-2024-26130

openSUSE-SU-2024:13710-1 — python310-cryptography-42.0.4-1.1 on GA media

python310-cryptography-42.0.4-1.1 on GA media

PYSEC-2024-225

Affected: PyPI: cryptography

RHSA-2024:3781 — Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update

pip: Mercurial configuration injectable in repo revision when installing via pip golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS golang: net/http: golang: mime/multipart: golang: net/textproto: memory exhaustion in Request.ParseMultipartForm python-cryptography: NULL-dereference when loading PKCS7 certificates pillow: Arbitrary Code Execution via the environment parameter python-gunicorn: HTTP Request Smuggling due to improper validation of Transfer-Encoding headers python-idna: potential DoS via resource consumption via specially crafted inputs to idna.encode() python-pydantic: regular expression denial of service via crafted email string sqlparse: parsing heavily nested list leads to denial of service psf/black: ReDoS via the lines_with_leading_tabs_expanded() function in strings.py file golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm python-cryptography: NULL pointer dereference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override aiohttp: XSS on index pages for static file handling python-django: Potential regular expression denial-of-service in django.utils.text.Truncator.words() python-pillow: buffer overflow in _imagingcms.c follow-redirects: Possible credential leak aiohttp: DoS when trying to parse malformed POST requests python-social-auth: Improper Handling of Case Sensitivity in social-auth-app-django jinja2: accept…

SUSE-SU-2024:0763-1 — Security update for python-cryptography

Security update for python-cryptography

UBUNTU-CVE-2024-26130

Affected: Ubuntu:24.04:LTS: python-cryptography

WID-SEC-W-2024-0869 — Oracle Communications: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Communications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.