CVE-2023-49083
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2023-49083
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-49083.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2023-49083
- Aliases
- Downstream
- Related
- Published
- 2023-11-29T18:50:24Z
- Modified
- 2025-10-21T13:33:04.175288Z
- Severity
-
- 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- cryptography vulnerable to NULL-dereference when loading PKCS7 certificates
- Details
-
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling
load_pem_pkcs7_certificatesorload_der_pkcs7_certificatescould lead to a NULL-pointer dereference and segfault. Exploitation of this vulnerability poses a serious risk of Denial of Service (DoS) for any application attempting to deserialize a PKCS7 blob/certificate. The consequences extend to potential disruptions in system availability and stability. This vulnerability has been patched in version 41.0.6. - References
-
- https://github.com/pyca/cryptography/security/advisories/GHSA-jfhm-5ghh-2f97
- https://github.com/pyca/cryptography/commit/f09c261ca10a31fe41b1262306db7f8f1da0e48a
- https://github.com/pyca/cryptography/pull/9926
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QMNTYMUGFJSDBYBU22FUYBHFRZODRKXV/