CVE-2024-26130
published 2024-02-21CVE-2024-26130: cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Starting in version 38.0.0 and prior to version 42.0.4…
PriorityP337high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.83%
53.5th percentile
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Starting in version 38.0.0 and prior to version 42.0.4, if `pkcs12.serialize_key_and_certificates` is called with both a certificate whose public key did not match the provided private key and an `encryption_algorithm` with `hmac_hash` set (via `PrivateFormat.PKCS12.encryption_builder().hmac_hash(...)`, then a NULL pointer dereference would occur, crashing the Python process. This has been resolved in version 42.0.4, the first version in which a `ValueError` is properly raised.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cryptography.io | cryptography | >= 38.0.0 < 42.0.4 | 42.0.4 |
| cryptography.io | cryptography | >= 38.0.0 < 42.0.4 | 42.0.4 |
| debian | python-cryptography | < python-cryptography 38.0.4-3+deb12u1 (bookworm) | python-cryptography 38.0.4-3+deb12u1 (bookworm) |
| pyca | cryptography | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
osv7.5HIGH
vendor_debian7.5HIGH
vendor_oracle7.5HIGH
vendor_redhat7.5HIGH
vendor_ubuntu7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Oracle
Oracle Oracle Analytics Risk Matrix: Analytics Server (OpenSSL) — CVE-2024-26130
vendor_oracle·2025-01-15·CVSS 7.5
CVE-2024-26130 [HIGH] Oracle Oracle Analytics Risk Matrix: Analytics Server (OpenSSL) — CVE-2024-26130
Oracle Oracle Analytics Risk Matrix: Analytics Server (OpenSSL) vulnerability
CVE: CVE-2024-26130
CVSS: 7.5
Protocol: TLS
Remote exploit: Yes
Affected versions: Network
Advisory: cpujan2025 (JAN 2025)
Oracle
Oracle Oracle PeopleSoft Risk Matrix: Porting (Cryptography) — CVE-2024-26130
vendor_oracle·2024-10-15·CVSS 7.5
CVE-2024-26130 [HIGH] Oracle Oracle PeopleSoft Risk Matrix: Porting (Cryptography) — CVE-2024-26130
Oracle Oracle PeopleSoft Risk Matrix: Porting (Cryptography) vulnerability
CVE: CVE-2024-26130
CVSS: 7.5
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuoct2024 (OCT 2024)
Oracle
Oracle Oracle Communications Risk Matrix: Install (Cryptography) — CVE-2024-26130
vendor_oracle·2024-07-15·CVSS 7.5
CVE-2024-26130 [HIGH] Oracle Oracle Communications Risk Matrix: Install (Cryptography) — CVE-2024-26130
Oracle Oracle Communications Risk Matrix: Install (Cryptography) vulnerability
CVE: CVE-2024-26130
CVSS: 7.5
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujul2024 (JUL 2024)
Ubuntu
python-cryptography vulnerability
vendor_ubuntu·2024-05-27·CVSS 7.5
CVE-2024-26130 [HIGH] python-cryptography vulnerability
Title: python-cryptography vulnerability
Summary: python-cryptography could be made to crash if it received specially crafted
input.
USN-6673-1 provided a security update for python-cryptography.
This update provides the corresponding update for Ubuntu 24.04 LTS.
Original advisory details:
It was discovered that python-cryptography incorrectly handled memory
operations when processing mismatched PKCS#12 keys. A remote attacker could
possibly use this issue to cause python-cryptography to crash, leading to a
denial of service. This issue only affected Ubuntu 23.10. (CVE-2024-26130)
Instructions: In general, a standard system update will make all the necessary changes.
Oracle
Oracle Oracle Communications Risk Matrix: Install/Upgrade (Cryptography) — CVE-2024-26130
vendor_oracle·2024-04-15·CVSS 7.5
CVE-2024-26130 [HIGH] Oracle Oracle Communications Risk Matrix: Install/Upgrade (Cryptography) — CVE-2024-26130
Oracle Oracle Communications Risk Matrix: Install/Upgrade (Cryptography) vulnerability
CVE: CVE-2024-26130
CVSS: 7.5
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuapr2024 (APR 2024)
Ubuntu
python-cryptography vulnerabilities
vendor_ubuntu·2024-03-04·CVSS 7.5
CVE-2024-26130 [HIGH] python-cryptography vulnerabilities
Title: python-cryptography vulnerabilities
Summary: Several security issues were fixed in python-cryptography.
Hubert Kario discovered that python-cryptography incorrectly handled
errors returned by the OpenSSL API when processing incorrect padding in
RSA PKCS#1 v1.5. A remote attacker could possibly use this issue to expose
confidential or sensitive information. (CVE-2023-50782)
It was discovered that python-cryptography incorrectly handled memory
operations when processing mismatched PKCS#12 keys. A remote attacker could
possibly use this issue to cause python-cryptography to crash, leading to a
denial of service. This issue only affected Ubuntu 23.10. (CVE-2024-26130)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
python-cryptography: NULL pointer dereference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override
vendor_redhat·2024-02-21·CVSS 7.5
CVE-2024-26130 [HIGH] CWE-476 python-cryptography: NULL pointer dereference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override
python-cryptography: NULL pointer dereference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Starting in version 38.0.0 and prior to version 42.0.4, if `pkcs12.serialize_key_and_certificates` is called with both a certificate whose public key did not match the provided private key and an `encryption_algorithm` with `hmac_hash` set (via `PrivateFormat.PKCS12.encryption_builder().hmac_hash(...)`, then a NULL pointer dereference would occur, crashing the Python process. This has been resolved in version 42.0.4, the first version in which a `ValueError` is properly raised.
A flaw was discovered in python-cryp
Debian
CVE-2024-26130: python-cryptography - cryptography is a package designed to expose cryptographic primitives and recipe...
vendor_debian·2024·CVSS 7.5
CVE-2024-26130 [HIGH] CVE-2024-26130: python-cryptography - cryptography is a package designed to expose cryptographic primitives and recipe...
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Starting in version 38.0.0 and prior to version 42.0.4, if `pkcs12.serialize_key_and_certificates` is called with both a certificate whose public key did not match the provided private key and an `encryption_algorithm` with `hmac_hash` set (via `PrivateFormat.PKCS12.encryption_builder().hmac_hash(...)`, then a NULL pointer dereference would occur, crashing the Python process. This has been resolved in version 42.0.4, the first version in which a `ValueError` is properly raised.
Scope: local
bookworm: resolved (fixed in 38.0.4-3+deb12u1)
bullseye: resolved
forky: resolved (fixed in 42.0.5-1)
sid: resolved (fixed in 42.0.5-1)
trixie: resolved (fixed in 42.0.5-1)
OSV
python-cryptography vulnerability
osv·2024-05-27·CVSS 7.5
CVE-2024-26130 [HIGH] python-cryptography vulnerability
python-cryptography vulnerability
USN-6673-1 provided a security update for python-cryptography.
This update provides the corresponding update for Ubuntu 24.04 LTS.
Original advisory details:
It was discovered that python-cryptography incorrectly handled memory
operations when processing mismatched PKCS#12 keys. A remote attacker could
possibly use this issue to cause python-cryptography to crash, leading to a
denial of service. This issue only affected Ubuntu 23.10. (CVE-2024-26130)
OSV
python-cryptography vulnerabilities
osv·2024-03-04·CVSS 7.5
CVE-2023-50782 [HIGH] python-cryptography vulnerabilities
python-cryptography vulnerabilities
Hubert Kario discovered that python-cryptography incorrectly handled
errors returned by the OpenSSL API when processing incorrect padding in
RSA PKCS#1 v1.5. A remote attacker could possibly use this issue to expose
confidential or sensitive information. (CVE-2023-50782)
It was discovered that python-cryptography incorrectly handled memory
operations when processing mismatched PKCS#12 keys. A remote attacker could
possibly use this issue to cause python-cryptography to crash, leading to a
denial of service. This issue only affected Ubuntu 23.10. (CVE-2024-26130)
OSV
CVE-2024-26130: cryptography is a package designed to expose cryptographic primitives and recipes to Python developers
osv·2024-02-21·CVSS 7.5
CVE-2024-26130 [HIGH] CVE-2024-26130: cryptography is a package designed to expose cryptographic primitives and recipes to Python developers
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Starting in version 38.0.0 and prior to version 42.0.4, if `pkcs12.serialize_key_and_certificates` is called with both a certificate whose public key did not match the provided private key and an `encryption_algorithm` with `hmac_hash` set (via `PrivateFormat.PKCS12.encryption_builder().hmac_hash(...)`, then a NULL pointer dereference would occur, crashing the Python process. This has been resolved in version 42.0.4, the first version in which a `ValueError` is properly raised.
OSV
cryptography NULL pointer dereference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override
osv·2024-02-21
CVE-2024-26130 [HIGH] cryptography NULL pointer dereference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override
cryptography NULL pointer dereference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override
If `pkcs12.serialize_key_and_certificates` is called with both:
1. A certificate whose public key did not match the provided private key
2. An `encryption_algorithm` with `hmac_hash` set (via `PrivateFormat.PKCS12.encryption_builder().hmac_hash(...)`
Then a NULL pointer dereference would occur, crashing the Python process.
This has been resolved, and now a `ValueError` is properly raised.
Patched in https://github.com/pyca/cryptography/pull/10423
GHSA
cryptography NULL pointer dereference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override
ghsa·2024-02-21
CVE-2024-26130 [HIGH] CWE-476 cryptography NULL pointer dereference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override
cryptography NULL pointer dereference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override
If `pkcs12.serialize_key_and_certificates` is called with both:
1. A certificate whose public key did not match the provided private key
2. An `encryption_algorithm` with `hmac_hash` set (via `PrivateFormat.PKCS12.encryption_builder().hmac_hash(...)`
Then a NULL pointer dereference would occur, crashing the Python process.
This has been resolved, and now a `ValueError` is properly raised.
Patched in https://github.com/pyca/cryptography/pull/10423
No detection rules found.
No public exploits indexed.
https://github.com/pyca/cryptography/commit/97d231672763cdb5959a3b191e692a362f1b9e55https://github.com/pyca/cryptography/pull/10423https://github.com/pyca/cryptography/security/advisories/GHSA-6vqw-3v5j-54x4https://github.com/pyca/cryptography/commit/97d231672763cdb5959a3b191e692a362f1b9e55https://github.com/pyca/cryptography/pull/10423https://github.com/pyca/cryptography/security/advisories/GHSA-6vqw-3v5j-54x4
2024-02-21
Published