Asymmetric denial of service In python-cryptography
Description
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling load_pem_pkcs7_certificates or load_der_pkcs7_certificates could lead to a NULL-pointer dereference and segfault. Exploitation of this vulnerability poses a serious risk of Denial of Service (DoS) for any application attempting to deserialize a PKCS7 blob/certificate. The consequences extend to potential disruptions in system availability and stability. This vulnerability has been patched in version 41.0.6.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 debian 11 | 3.3.2-1+deb11u1 | ||
debian 12 | 38.0.4-3+deb12u1 | ||
debian 13 | 41.0.7-1 | ||
debian 14 | 41.0.7-1 | ||
 pypi | 41.0.6 | ||
 rpm rhel7 | - | - | |
rpm rhel8 | 0:3.2.1-8.el8_10 | ||
rpm rhel8.4 | 0:3.2.1-4.el8_4.1 | ||
rpm rhel9 | 0:36.0.1-5.el9_6 | ||
rpm rhel9.4 | 0:36.0.1-4.el9_4.1 |
1-10 of 13
10
Aliases
References