CVE-2024-26130

CWE-476 — NULL Pointer Dereference15 documents8 sources
Severity
7.5HIGH
EPSS
0.4%
top 37.76%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Cryptography.io CryptographyPyca Cryptography
Timeline
PublishedFeb 21
Latest updateJan 15

Description

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Starting in version 38.0.0 and prior to version 42.0.4, if `pkcs12.serialize_key_and_certificates` is called with both a certificate whose public key did not match the provided private key and an `encryption_algorithm` with `hmac_hash` set (via `PrivateFormat.PKCS12.encryption_builder().hmac_hash(...)`, then a NULL pointer dereference would occur, crashing the Python process. This has been res…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages5 packages

▶Debianpython-cryptography< 38.0.4-3+deb12u1+2
▶Ubuntupython-cryptography< 41.0.7-4ubuntu0.1
▶PyPIcryptography38.0.0 — 42.0.4
▶NVDcryptography.io/cryptography38.0.0 — 42.0.4
▶CVEListV5pyca/cryptography>= 38.0.0, < 42.0.4

Patches

Patch: github.com ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

6
OSV
python-cryptography vulnerability↗2024-05-27
▶
OSV
python-cryptography vulnerabilities↗2024-03-04
▶
OSV
CVE-2024-26130: cryptography is a package designed to expose cryptographic primitives and recipes to Python developers↗2024-02-21
▶
OSV
cryptography NULL pointer dereference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override↗2024-02-21
▶
GHSA
cryptography NULL pointer dereference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override↗2024-02-21
▶

📋Vendor Advisories

8
Oracle
Oracle Oracle Analytics Risk Matrix: Analytics Server (OpenSSL) — CVE-2024-26130↗2025-01-15
▶
Oracle
Oracle Oracle PeopleSoft Risk Matrix: Porting (Cryptography) — CVE-2024-26130↗2024-10-15
▶
Oracle
Oracle Oracle Communications Risk Matrix: Install (Cryptography) — CVE-2024-26130↗2024-07-15
▶
Ubuntu
python-cryptography vulnerability↗2024-05-27
▶
Oracle
Oracle Oracle Communications Risk Matrix: Install/Upgrade (Cryptography) — CVE-2024-26130↗2024-04-15
▶