CVE-2023-49083 cryptography vulnerable to NULL-dereference when loading PKCS7 certificates

2023-11-2918:50:24

CWE-476

GitHub_M

www.cve.org

cryptography

pkcs7

null-dereference

dos

patch

5.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

7.7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

25.1%

JSON

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling load_pem_pkcs7_certificates or load_der_pkcs7_certificates could lead to a NULL-pointer dereference and segfault. Exploitation of this vulnerability poses a serious risk of Denial of Service (DoS) for any application attempting to deserialize a PKCS7 blob/certificate. The consequences extend to potential disruptions in system availability and stability. This vulnerability has been patched in version 41.0.6.

CNA Affected

[
  {
    "vendor": "pyca",
    "product": "cryptography",
    "versions": [
      {
        "version": ">= 3.1, < 41.0.6",
        "status": "affected"
      }
    ]
  }
]