Vulnerabilities > CVE-2023-49083 - NULL Pointer Dereference vulnerability in Cryptography.Io Cryptography

CVSS 7.5 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

NONE

Availability impact

HIGH

network

low complexity

cryptography-io

CWE-476

NVD

Published: 2023-11-29

Updated: 2024-09-05

Summary

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling `load_pem_pkcs7_certificates` or `load_der_pkcs7_certificates` could lead to a NULL-pointer dereference and segfault. Exploitation of this vulnerability poses a serious risk of Denial of Service (DoS) for any application attempting to deserialize a PKCS7 blob/certificate. The consequences extend to potential disruptions in system availability and stability. This vulnerability has been patched in version 41.0.6.

Vulnerable Configurations

Part	Description	Count
Application	Cryptography.Io Cryptography.Io Cryptography 3.1 Cryptography.Io Cryptography 3.1.1 Cryptography.Io Cryptography 3.2 Cryptography.Io Cryptography 3.2.1 Cryptography.Io Cryptography 3.3 Cryptography.Io Cryptography 3.3.1 Cryptography.Io Cryptography 3.3.2 Cryptography.Io Cryptography 3.4 Cryptography.Io Cryptography 3.4.1 Cryptography.Io Cryptography 3.4.2 Cryptography.Io Cryptography 3.4.3 Cryptography.Io Cryptography 3.4.4 Cryptography.Io Cryptography 3.4.5 Cryptography.Io Cryptography 3.4.6 Cryptography.Io Cryptography 3.4.7 Cryptography.Io Cryptography 3.4.8 Cryptography.Io Cryptography 35.0.0 Cryptography.Io Cryptography 36.0.0 Cryptography.Io Cryptography 36.0.1 Cryptography.Io Cryptography 36.0.2 Cryptography.Io Cryptography 37.0.0 Cryptography.Io Cryptography 37.0.1 Cryptography.Io Cryptography 37.0.2 Cryptography.Io Cryptography 37.0.3 Cryptography.Io Cryptography 37.0.4 Cryptography.Io Cryptography 38.0.0 Cryptography.Io Cryptography 38.0.1 Cryptography.Io Cryptography 38.0.2 Cryptography.Io Cryptography 38.0.3 Cryptography.Io Cryptography 38.0.4 Cryptography.Io Cryptography 39.0.0 Cryptography.Io Cryptography 39.0.1 Cryptography.Io Cryptography 39.0.2 Cryptography.Io Cryptography 40.0.0 Cryptography.Io Cryptography 40.0.1 Cryptography.Io Cryptography 40.0.2 Cryptography.Io Cryptography 41.0.0 Cryptography.Io Cryptography 41.0.1 Cryptography.Io Cryptography 41.0.2 Cryptography.Io Cryptography 41.0.3 Cryptography.Io Cryptography 41.0.4 Cryptography.Io Cryptography 41.0.5	42

Common Weakness Enumeration (CWE)

CWE-476 - NULL Pointer Dereference

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References