CVE-2024-26130

2024-02-2100:00:00

ubuntu.com

cve-2024-26130

cryptography package

python developers

version 38.0.0

version 42.0.4

pkcs12.serialize_key_and_certificates

certificate

public key

private key

encryption algorithm

hmac_hash

null pointer dereference

crash

python process

valueerror

unix

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

6.9 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

15.5%

JSON

cryptography is a package designed to expose cryptographic primitives and
recipes to Python developers. Starting in version 38.0.0 and prior to
version 42.0.4, if pkcs12.serialize_key_and_certificates is called with
both a certificate whose public key did not match the provided private key
and an encryption_algorithm with hmac_hash set (via
PrivateFormat.PKCS12.encryption_builder().hmac_hash(...), then a NULL
pointer dereference would occur, crashing the Python process. This has been
resolved in version 42.0.4, the first version in which a ValueError is
properly raised.

OSVersionArchitecturePackageVersionFilename
ubuntu23.10noarchpython-cryptography< 38.0.4-4ubuntu0.23.10.2UNKNOWN
ubuntu24.04noarchpython-cryptography< 41.0.7-4ubuntu0.1UNKNOWN