The vulnerabilities of the functions load_pem_pkcs7_certificates() and load_der_pkcs7_certificates() in the cryptography package allow a perpetrator to cause a service failure.

🗓️ 03 Apr 2024 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec🔗 bdu.fstec.ru👁 7 Views

Cryptography library vulnerable: load_pem_pkcs7_certificates and load_der_pkcs7_certificates may crash via NULL pointers.

Reporter	Title	Published	Views	Family All 226
IBM Security Bulletins	Security Bulletin: Vulnerability in Cryptography package for Python affects IBM Process Mining CVE-2023-49083	15 Dec 202319:45	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Cloud Pak for Multicloud Management	28 Feb 202421:30	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Storage Ceph is vulnerable to a NULL Pointer Dereference in the RHEL UBI (CVE-2023-49083)	5 Aug 202422:07	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities exists in IBM Netezza Performance Server Replication Services	27 Feb 202619:55	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Cryptography, Werkzeug might affect IBM Storage Sentinel Anomaly Scan Engine (CVE-2023-49083, CVE-2023-46136)	22 Mar 202416:13	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for January 2024.	2 Feb 202408:25	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar App SDK for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	9 Apr 202418:57	–	ibm
IBM Security Bulletins	Security Bulletin: QRadar Suite Software includes components with multiple known vulnerabilities	10 Apr 202409:27	–	ibm
IBM Security Bulletins	Security Bulletin: Cryptography-41.0.3 and cryptography-41.0.5 is vulnerable to CVE-2023-49083 used in IBM Maximo Application Suite - Edge Data Collector	5 Mar 202409:14	–	ibm
IBM Security Bulletins	Security Bulletin: Cryptography expose cryptographic primitives and recipes	1 Jul 202510:02	–	ibm

Vulners

Node

python_cryptographic_authority cryptographyRange3.1–41.0.6

Source	Link
github	www.github.com/pyca/cryptography/commit/f09c261ca10a31fe41b1262306db7f8f1da0e48a
github	www.github.com/pyca/cryptography/pull/9926
github	www.github.com/pyca/cryptography/security/advisories/GHSA-jfhm-5ghh-2f97
redos	www.redos.red-soft.ru/support/secure/
altsp	www.altsp.su/obnovleniya-bezopasnosti/
errata	www.errata.msvsphere-os.ru/definition/9/INFCSA-2025:15874
web	www.web.nvd.nist.gov/view/vuln/detail

19 Nov 2025 00:00Current

6.5Medium risk

Vulners AI Score6.5

CVSS 37.5

CVSS 27.8

EPSS0.00985

cryptography library pkcs seven certificates null pointer remote attacker