CVE-2023-49083

2023-12-0400:00:00

ubuntu.com

cryptography

cryptographic primitives

dos

pkcs7

blob

certificate

deserialization

null-pointer dereference

segfault

vulnerability

patch

version 41.0.6

debian

mdeslaur

unix

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.1 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

25.1%

JSON

cryptography is a package designed to expose cryptographic primitives and
recipes to Python developers. Calling load_pem_pkcs7_certificates or
load_der_pkcs7_certificates could lead to a NULL-pointer dereference and
segfault. Exploitation of this vulnerability poses a serious risk of Denial
of Service (DoS) for any application attempting to deserialize a PKCS7
blob/certificate. The consequences extend to potential disruptions in
system availability and stability. This vulnerability has been patched in
version 41.0.6.

Bugs

<http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1057108>

Notes

Author	Note
mdeslaur	only affects 3.1 and higher

OSVersionArchitecturePackageVersionFilename
ubuntu22.04noarchpython-cryptography< 3.4.8-1ubuntu2.1UNKNOWN
ubuntu23.04noarchpython-cryptography< 38.0.4-2ubuntu0.1UNKNOWN
ubuntu23.10noarchpython-cryptography< 38.0.4-4ubuntu0.23.10.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	22.04	noarch	python-cryptography	< 3.4.8-1ubuntu2.1	UNKNOWN
ubuntu	23.04	noarch	python-cryptography	< 38.0.4-2ubuntu0.1	UNKNOWN
ubuntu	23.10	noarch	python-cryptography	< 38.0.4-4ubuntu0.23.10.1	UNKNOWN