cryptography vulnerable to NULL-dereference when loading PKCS7 certificates

CVE-2023-49083

What is CVE-2023-49083?

The Cryptography package in Python is vulnerable to a NULL-pointer dereference issue that can occur when calling either load_pem_pkcs7_certificates or load_der_pkcs7_certificates. This may result in a segmentation fault, potentially leading to a Denial of Service (DoS) situation for applications that attempt to deserialize a malformed PKCS7 blob or certificate. The exploitation of this flaw threatens system availability and performance, making it crucial for users to update their installations to version 41.0.6 or later to mitigate these risks.

References