{"id":"CVE-2023-49083","published":"2023-11-29T18:50:24Z","modified":"2025-12-18T15:32:14Z","title":"cryptography vulnerable to NULL-dereference when loading PKCS7 certificates","vendor":"pyca","product":"cryptography","tier":"tail","description":{"text":"cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling `load_pem_pkcs7_certificates` or `load_der_pkcs7_certificates` could lead to a NULL-pointer dereference and segfault. Exploitation of this vulnerability poses a serious risk of Denial of Service (DoS) for any application attempting to deserialize a PKCS7 blob/certificate. The consequences extend to potential disruptions in system availability and stability. This vulnerability has been patched in version 41.0.6.","provenance":"source","from":"CVE.org"},"cvss":{"score":5.9,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00985,"percentile":0.62318,"provenance":"source"},"cwes":[{"id":"CWE-476","name":"NULL Pointer Dereference"}],"references":[{"url":"https://github.com/pyca/cryptography/security/advisories/GHSA-jfhm-5ghh-2f97","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/pyca/cryptography/pull/9926","tags":["x_refsource_MISC"]},{"url":"https://github.com/pyca/cryptography/commit/f09c261ca10a31fe41b1262306db7f8f1da0e48a","tags":["x_refsource_MISC"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QMNTYMUGFJSDBYBU22FUYBHFRZODRKXV/","tags":[]},{"url":"https://lists.debian.org/debian-lts-announce/2024/10/msg00012.html","tags":[]}],"priority":{"score":16.6,"factors":[{"name":"EPSS percentile","points":12.46},{"name":"CVSS severity","points":4.13}]},"vendorSlug":"pyca","affectedVersions":[{"vendor":"pyca","product":"cryptography","versions":[">= 3.1, < 41.0.6"]}],"affected":[{"ecosystem":"PyPI","package":"cryptography","vulnerableRanges":[">=3.1, <41.0.6"],"patched":["41.0.6"],"from":["GHSA-jfhm-5ghh-2f97","PYSEC-2023-254"],"provenance":"source"}],"euvd":{"id":"EUVD-2023-0060","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-pyca-cryptography-cve-2020-36242","parents":[{"from":"CVE-2020-36242","to":"CVE-2023-49083","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["src/cryptography/__about__.py","vectors/cryptography_vectors/__about__.py"],"commits":["https://github.com/pyca/cryptography/commit/82b6ce28389f0a317bc55ba2091a74b346db7cae","https://github.com/pyca/cryptography/commit/f09c261ca10a31fe41b1262306db7f8f1da0e48a"],"basis":"rarely changed file"}]}],"children":[{"from":"CVE-2023-49083","to":"CVE-2024-26130","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["src/cryptography/hazmat/backends/openssl/backend.py"],"commits":["https://github.com/pyca/cryptography/commit/f09c261ca10a31fe41b1262306db7f8f1da0e48a","https://github.com/pyca/cryptography/commit/97d231672763cdb5959a3b191e692a362f1b9e55"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2023-0286","published":"2023-02-08","fixed":"39.0.1","kev":false},{"cve":"CVE-2023-23931","published":"2023-02-07","fixed":"39.0.1","kev":false},{"cve":"CVE-2023-38325","published":"2023-07-14","fixed":"41.0.2","kev":false,"link":{"from":"CVE-2023-38325","to":"CVE-2023-49083","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:cryptography","fromFixed":"41.0.2","toFixed":"41.0.6","daysApart":138}]}},{"cve":"CVE-2023-49083","published":"2023-11-29","fixed":"41.0.6","kev":false},{"cve":"CVE-2023-50782","published":"2024-02-05","fixed":"42.0.0","kev":false},{"cve":"CVE-2024-0727","published":"2024-01-26","fixed":"42.0.2","kev":false},{"cve":"CVE-2024-26130","published":"2024-02-21","fixed":"42.0.4","kev":false}],"package":"PyPI:cryptography"}}