CVE-2024-26130 — cryptography NULL pointer deference with pkcs12.serialize_key_and_certificates when called with a non-matching certific…

Affected: pyca cryptography, cryptography_project cryptography

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Starting in version 38.0.0 and prior to version 42.0.4, if `pkcs12.serialize_key_and_certificates` is called with both a certificate whose public key did not match the provided private key and an `encryption_algorithm` with `hmac_hash` set (via `PrivateFormat.PKCS12.encryption_builder().hmac_hash(...)`, then a NULL pointer dereference would occur, crashing the Python process. This has been resolved in version 42.0.4, the first version in which a `ValueError` is properly raised.

USN-6673-1 — python-cryptography vulnerabilities

Affected: Ubuntu:Pro:18.04:LTS: python-cryptography, Ubuntu:20.04:LTS: python-cryptography, Ubuntu:22.04:LTS: python-cryptography

Hubert Kario discovered that python-cryptography incorrectly handled errors returned by the OpenSSL API when processing incorrect padding in RSA PKCS#1 v1.5. A remote attacker could possibly use this issue to expose confidential or sensitive information. (CVE-2023-50782)

It was discovered that python-cryptography incorrectly handled memory operations when processing mismatched PKCS#12 keys. A remote attacker could possibly use this issue to cause python-cryptography to crash, leading to a denial of service. This issue only affected Ubuntu 23.10. (CVE-2024-26130)

Most recent entries from all

CVE-2024-26130 — cryptography NULL pointer deference with pkcs12.serialize_key_and_certificates when called with a non-matching certific…

USN-6673-1 — python-cryptography vulnerabilities