Vulnerabilities > CVE-2023-49083 - NULL Pointer Dereference vulnerability in Cryptography Project Cryptography

CVSS 7.5 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

NONE

Availability impact

HIGH

network

low complexity

cryptography-project

CWE-476

NVD

Published: 2023-11-29

Updated: 2024-02-17

Summary

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling `load_pem_pkcs7_certificates` or `load_der_pkcs7_certificates` could lead to a NULL-pointer dereference and segfault. Exploitation of this vulnerability poses a serious risk of Denial of Service (DoS) for any application attempting to deserialize a PKCS7 blob/certificate. The consequences extend to potential disruptions in system availability and stability. This vulnerability has been patched in version 41.0.6.

Vulnerable Configurations

Part	Description	Count
Application	Cryptography_Project Cryptography Project Cryptography 3.1 Cryptography Project Cryptography 3.1.1 Cryptography Project Cryptography 3.2 Cryptography Project Cryptography 3.2.1 Cryptography Project Cryptography 3.3 Cryptography Project Cryptography 3.3.1 Cryptography Project Cryptography 3.3.2 Cryptography Project Cryptography 3.4 Cryptography Project Cryptography 3.4.1 Cryptography Project Cryptography 3.4.2 Cryptography Project Cryptography 3.4.3 Cryptography Project Cryptography 3.4.4 Cryptography Project Cryptography 3.4.5 Cryptography Project Cryptography 3.4.6 Cryptography Project Cryptography 3.4.7 Cryptography Project Cryptography 3.4.8 Cryptography Project Cryptography 35.0.0 Cryptography Project Cryptography 36.0.0 Cryptography Project Cryptography 36.0.1 Cryptography Project Cryptography 36.0.2 Cryptography Project Cryptography 37.0.0 Cryptography Project Cryptography 37.0.1 Cryptography Project Cryptography 37.0.2 Cryptography Project Cryptography 37.0.3 Cryptography Project Cryptography 37.0.4 Cryptography Project Cryptography 38.0.0 Cryptography Project Cryptography 38.0.1 Cryptography Project Cryptography 38.0.2 Cryptography Project Cryptography 38.0.3 Cryptography Project Cryptography 38.0.4 Cryptography Project Cryptography 39.0.0 Cryptography Project Cryptography 39.0.1 Cryptography Project Cryptography 39.0.2 Cryptography Project Cryptography 40.0.0 Cryptography Project Cryptography 40.0.1 Cryptography Project Cryptography 40.0.2 Cryptography Project Cryptography 41.0.0 Cryptography Project Cryptography 41.0.1 Cryptography Project Cryptography 41.0.2 Cryptography Project Cryptography 41.0.3 Cryptography Project Cryptography 41.0.4 Cryptography Project Cryptography 41.0.5	42

Common Weakness Enumeration (CWE)

CWE-476 - NULL Pointer Dereference

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References