Asymmetric denial of service In cryptography
Description
cryptography NULL pointer dereference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override
If pkcs12.serialize_key_and_certificates is called with both:
A certificate whose public key did not match the provided private key
An encryption_algorithm with hmac_hash set (via PrivateFormat.PKCS12.encryption_builder().hmac_hash(...)
Then a NULL pointer dereference would occur, crashing the Python process.
This has been resolved, and now a ValueError is properly raised.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 pypi | 42.0.4 | ||
 debian 12 | 38.0.4-3+deb12u1 | ||
debian 13 | 42.0.5-1 | ||
debian 14 | 42.0.5-1 | ||
 rpm rhel9 | 0:41.0.7-2.el9_6.1 |
Aliases
1. 2. 3. 4. 5. 6. 7.
References
1. 2. 3. 4.