GHSA-6vqw-3v5j-54x4

Source

https://github.com/advisories/GHSA-6vqw-3v5j-54x4

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/02/GHSA-6vqw-3v5j-54x4/GHSA-6vqw-3v5j-54x4.json

Aliases

• CVE-2024-26130

Published

2024-02-21T18:04:40Z

Modified

2024-02-21T23:01:06.779298Z

Details

If pkcs12.serialize_key_and_certificates is called with both:

1. A certificate whose public key did not match the provided private key
2. An encryption_algorithm with hmac_hash set (via PrivateFormat.PKCS12.encryption_builder().hmac_hash(...)

Then a NULL pointer dereference would occur, crashing the Python process.

This has been resolved, and now a ValueError is properly raised.

Patched in https://github.com/pyca/cryptography/pull/10423

References

• https://github.com/pyca/cryptography/security/advisories/GHSA-6vqw-3v5j-54x4
• https://nvd.nist.gov/vuln/detail/CVE-2024-26130
• https://github.com/pyca/cryptography/pull/10423
• https://github.com/pyca/cryptography/commit/97d231672763cdb5959a3b191e692a362f1b9e55
• https://github.com/pyca/cryptography