CVE-2023-49083
published 2023-11-29CVE-2023-49083: cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling `load_pem_pkcs7_certificates` or…
PriorityP336high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.98%
58.5th percentile
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling `load_pem_pkcs7_certificates` or `load_der_pkcs7_certificates` could lead to a NULL-pointer dereference and segfault. Exploitation of this vulnerability poses a serious risk of Denial of Service (DoS) for any application attempting to deserialize a PKCS7 blob/certificate. The consequences extend to potential disruptions in system availability and stability. This vulnerability has been patched in version 41.0.6.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cryptography.io | cryptography | >= 3.1 < 41.0.6 | 41.0.6 |
| cryptography.io | cryptography | >= 3.1 < 41.0.6 | 41.0.6 |
| debian | python-cryptography | < python-cryptography 38.0.4-3+deb12u1 (bookworm) | python-cryptography 38.0.4-3+deb12u1 (bookworm) |
| msrc | azl3_python-cryptography_3.3.2-5_on_azure_linux_3.0 | — | — |
| msrc | azl3_python-cryptography_42.0.5-1_on_azure_linux_3.0 | — | — |
| msrc | azure_linux_3.0_arm | — | — |
| msrc | azure_linux_3.0_x64 | — | — |
| msrc | cbl2_python-cryptography_3.3.2-6_on_cbl_mariner_2.0 | — | — |
| msrc | cbl_mariner_2.0_arm | — | — |
| msrc | cbl_mariner_2.0_x64 | — | — |
| paloalto | cortex_xdr | — | — |
| pyca | cryptography | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
osv7.5HIGH
vendor_oracle7.5MEDIUM
vendor_debian5.9MEDIUM
vendor_msrc5.9MEDIUM
vendor_redhat5.9MEDIUM
vendor_ubuntu4.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
python-cryptography vulnerabilities
osv·2023-12-06·CVSS 6.5
CVE-2023-23931 [MEDIUM] python-cryptography vulnerabilities
python-cryptography vulnerabilities
It was discovered that the python-cryptography Cipher.update_into function
would incorrectly accept objects with immutable buffers. This would result
in corrupted output, contrary to expectations. This issue only affected
Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 23.04. (CVE-2023-23931)
It was dicovered that python-cryptography incorrectly handled loading
certain PKCS7 certificates. A remote attacker could possibly use this
issue to cause python-cryptography to crash, resulting in a denial of
service. This issue only affected Ubuntu 22.04 LTS, Ubuntu 23.04, and
Ubuntu 23.10. (CVE-2023-49083)
OSV
CVE-2023-49083: cryptography is a package designed to expose cryptographic primitives and recipes to Python developers
osv·2023-11-29·CVSS 7.5
CVE-2023-49083 [HIGH] CVE-2023-49083: cryptography is a package designed to expose cryptographic primitives and recipes to Python developers
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling `load_pem_pkcs7_certificates` or `load_der_pkcs7_certificates` could lead to a NULL-pointer dereference and segfault. Exploitation of this vulnerability poses a serious risk of Denial of Service (DoS) for any application attempting to deserialize a PKCS7 blob/certificate. The consequences extend to potential disruptions in system availability and stability. This vulnerability has been patched in version 41.0.6.
OSV
cryptography vulnerable to NULL-dereference when loading PKCS7 certificates
osv·2023-11-28
CVE-2023-49083 [MEDIUM] cryptography vulnerable to NULL-dereference when loading PKCS7 certificates
cryptography vulnerable to NULL-dereference when loading PKCS7 certificates
### Summary
Calling `load_pem_pkcs7_certificates` or `load_der_pkcs7_certificates` could lead to a NULL-pointer dereference and segfault.
### PoC
Here is a Python code that triggers the issue:
```python
from cryptography.hazmat.primitives.serialization.pkcs7 import load_der_pkcs7_certificates, load_pem_pkcs7_certificates
pem_p7 = b"""
-----BEGIN PKCS7-----
MAsGCSqGSIb3DQEHAg==
-----END PKCS7-----
"""
der_p7 = b"\x30\x0B\x06\x09\x2A\x86\x48\x86\xF7\x0D\x01\x07\x02"
load_pem_pkcs7_certificates(pem_p7)
load_der_pkcs7_certificates(der_p7)
```
### Impact
Exploitation of this vulnerability poses a serious risk of Denial of Service (DoS) for any application attempting to deserialize a PKCS7 blob/certificate. The co
GHSA
cryptography vulnerable to NULL-dereference when loading PKCS7 certificates
ghsa·2023-11-28
CVE-2023-49083 [MEDIUM] CWE-476 cryptography vulnerable to NULL-dereference when loading PKCS7 certificates
cryptography vulnerable to NULL-dereference when loading PKCS7 certificates
### Summary
Calling `load_pem_pkcs7_certificates` or `load_der_pkcs7_certificates` could lead to a NULL-pointer dereference and segfault.
### PoC
Here is a Python code that triggers the issue:
```python
from cryptography.hazmat.primitives.serialization.pkcs7 import load_der_pkcs7_certificates, load_pem_pkcs7_certificates
pem_p7 = b"""
-----BEGIN PKCS7-----
MAsGCSqGSIb3DQEHAg==
-----END PKCS7-----
"""
der_p7 = b"\x30\x0B\x06\x09\x2A\x86\x48\x86\xF7\x0D\x01\x07\x02"
load_pem_pkcs7_certificates(pem_p7)
load_der_pkcs7_certificates(der_p7)
```
### Impact
Exploitation of this vulnerability poses a serious risk of Denial of Service (DoS) for any application attempting to deserialize a PKCS7 blob/certificate. The co
Palo Alto
PAN-SA-2024-0014 Informational Bulletin: Impact of OSS CVEs in Cortex XDR Agent
vendor_paloalto·2024-11-07·CVSS 6.8
CVE-2014-0195 [MEDIUM] PAN-SA-2024-0014 Informational Bulletin: Impact of OSS CVEs in Cortex XDR Agent
PAN-SA-2024-0014 Informational Bulletin: Impact of OSS CVEs in Cortex XDR Agent
The Palo Alto Networks Product Security Assurance team has evaluated the following open source software (OSS) CVEs as they relate to Cortex XDR Agent. While Cortex XDR Agent may include the
CVEs: CVE-2014-0195, CVE-2014-0224, CVE-2014-3509, CVE-2014-3512, CVE-2014-3513, CVE-2014-3567, CVE-2015-0209, CVE-2015-0292, CVE-2015-1789, CVE-2015-1791, CVE-2015-1793, CVE-2015-3194, CVE-2016-0705, CVE-2016-0797, CVE-2016-0798, CVE-2016-0799, CVE-2016-2105, CVE-2016-2106, CVE-2016-2108, CVE-2016-2109, CVE-2016-2176, CVE-2016-2177, CVE-2016-2179, CVE-2016-2180, CVE-2016-2181, CVE-2016-2182, CVE-2016-2183, CVE-2016-6302, CVE-2016-6303, CVE-2016-6304, CVE-2019-1551, CVE-2019-1552, CVE-2019-1559, CVE-2019-1563, CVE-2020-196
Oracle
Oracle Oracle Analytics Risk Matrix: Pipeline Test Failures (Cryptography) — CVE-2023-49083
vendor_oracle·2024-07-15·CVSS 7.5
CVE-2023-49083 [MEDIUM] Oracle Oracle Analytics Risk Matrix: Pipeline Test Failures (Cryptography) — CVE-2023-49083
Oracle Oracle Analytics Risk Matrix: Pipeline Test Failures (Cryptography) vulnerability
CVE: CVE-2023-49083
CVSS: 7.5
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujul2024 (JUL 2024)
Oracle
Oracle Oracle Communications Risk Matrix: Third Party (Cryptography) — CVE-2023-49083
vendor_oracle·2024-04-15·CVSS 7.5
CVE-2023-49083 [MEDIUM] Oracle Oracle Communications Risk Matrix: Third Party (Cryptography) — CVE-2023-49083
Oracle Oracle Communications Risk Matrix: Third Party (Cryptography) vulnerability
CVE: CVE-2023-49083
CVSS: 7.5
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuapr2024 (APR 2024)
Ubuntu
python-cryptography vulnerabilities
vendor_ubuntu·2023-12-06·CVSS 4.8
CVE-2023-49083 [MEDIUM] python-cryptography vulnerabilities
Title: python-cryptography vulnerabilities
Summary: Several security issues were fixed in python-cryptography.
It was discovered that the python-cryptography Cipher.update_into function
would incorrectly accept objects with immutable buffers. This would result
in corrupted output, contrary to expectations. This issue only affected
Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 23.04. (CVE-2023-23931)
It was dicovered that python-cryptography incorrectly handled loading
certain PKCS7 certificates. A remote attacker could possibly use this
issue to cause python-cryptography to crash, resulting in a denial of
service. This issue only affected Ubuntu 22.04 LTS, Ubuntu 23.04, and
Ubuntu 23.10. (CVE-2023-49083)
Instructions: In general, a standard system update will make all the necessary ch
Red Hat
python-cryptography: NULL-dereference when loading PKCS7 certificates
vendor_redhat·2023-11-28·CVSS 5.9
CVE-2023-49083 [MEDIUM] CWE-476 python-cryptography: NULL-dereference when loading PKCS7 certificates
python-cryptography: NULL-dereference when loading PKCS7 certificates
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling `load_pem_pkcs7_certificates` or `load_der_pkcs7_certificates` could lead to a NULL-pointer dereference and segfault. Exploitation of this vulnerability poses a serious risk of Denial of Service (DoS) for any application attempting to deserialize a PKCS7 blob/certificate. The consequences extend to potential disruptions in system availability and stability. This vulnerability has been patched in version 41.0.6.
A null-pointer dereference vulnerability was found in python-cryptography during the loading of PKCS7 certificates. Invoking "load_pem_pkcs7_certificates" or "load_der_pkcs7_certificates" can trigger t
Microsoft
cryptography vulnerable to NULL-dereference when loading PKCS7 certificates
vendor_msrc·2023-11-14·CVSS 5.9
CVE-2023-49083 [MEDIUM] CWE-476 cryptography vulnerable to NULL-dereference when loading PKCS7 certificates
cryptography vulnerable to NULL-dereference when loading PKCS7 certificates
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
GitHub_M: GitHub_M
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Debian
CVE-2023-49083: python-cryptography - cryptography is a package designed to expose cryptographic primitives and recipe...
vendor_debian·2023·CVSS 5.9
CVE-2023-49083 [MEDIUM] CVE-2023-49083: python-cryptography - cryptography is a package designed to expose cryptographic primitives and recipe...
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling `load_pem_pkcs7_certificates` or `load_der_pkcs7_certificates` could lead to a NULL-pointer dereference and segfault. Exploitation of this vulnerability poses a serious risk of Denial of Service (DoS) for any application attempting to deserialize a PKCS7 blob/certificate. The consequences extend to potential disruptions in system availability and stability. This vulnerability has been patched in version 41.0.6.
Scope: local
bookworm: resolved (fixed in 38.0.4-3+deb12u1)
bullseye: resolved (fixed in 3.3.2-1+deb11u1)
forky: resolved (fixed in 41.0.7-1)
sid: resolved (fixed in 41.0.7-1)
trixie: resolved (fixed in 41.0.7-1)
No detection rules found.
No public exploits indexed.
https://github.com/pyca/cryptography/commit/f09c261ca10a31fe41b1262306db7f8f1da0e48ahttps://github.com/pyca/cryptography/pull/9926https://github.com/pyca/cryptography/security/advisories/GHSA-jfhm-5ghh-2f97https://lists.fedoraproject.org/archives/list/[email protected]/message/QMNTYMUGFJSDBYBU22FUYBHFRZODRKXV/https://github.com/pyca/cryptography/commit/f09c261ca10a31fe41b1262306db7f8f1da0e48ahttps://github.com/pyca/cryptography/pull/9926https://github.com/pyca/cryptography/security/advisories/GHSA-jfhm-5ghh-2f97https://lists.debian.org/debian-lts-announce/2024/10/msg00012.htmlhttps://lists.fedoraproject.org/archives/list/[email protected]/message/QMNTYMUGFJSDBYBU22FUYBHFRZODRKXV/
2023-11-29
Published