Bug 2255331 (CVE-2023-49083) - CVE-2023-49083 python-cryptography: NULL-dereference when loading PKCS7 certificates
Summary: CVE-2023-49083 python-cryptography: NULL-dereference when loading PKCS7 certi...
Keywords:
Status: NEW
Alias: CVE-2023-49083
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2255353 2255358 2255351 2255352 2255354 2255356
Blocks: 2255359
TreeView+ depends on / blocked
 
Reported: 2023-12-20 07:26 UTC by TEJ RATHI
Modified: 2025-09-16 00:45 UTC (History)
71 users (show)

Fixed In Version: python-cryptography 41.0.6
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2024:10965 0 None None None 2024-12-11 18:24:36 UTC
Red Hat Product Errata RHSA-2024:1640 0 None None None 2024-04-02 19:30:17 UTC
Red Hat Product Errata RHSA-2024:1878 0 None None None 2024-04-18 01:52:04 UTC
Red Hat Product Errata RHSA-2024:2337 0 None None None 2024-04-30 10:04:15 UTC
Red Hat Product Errata RHSA-2024:3105 0 None None None 2024-05-22 09:45:38 UTC
Red Hat Product Errata RHSA-2024:3781 0 None None None 2024-06-10 18:37:02 UTC
Red Hat Product Errata RHSA-2025:13098 0 None None None 2025-08-06 00:24:57 UTC
Red Hat Product Errata RHSA-2025:13100 0 None None None 2025-08-06 00:37:15 UTC
Red Hat Product Errata RHSA-2025:13101 0 None None None 2025-08-06 00:36:27 UTC
Red Hat Product Errata RHSA-2025:13102 0 None None None 2025-08-06 00:27:59 UTC
Red Hat Product Errata RHSA-2025:13103 0 None None None 2025-08-06 00:37:51 UTC
Red Hat Product Errata RHSA-2025:13104 0 None None None 2025-08-06 00:43:43 UTC
Red Hat Product Errata RHSA-2025:14553 0 None None None 2025-08-26 00:38:39 UTC
Red Hat Product Errata RHSA-2025:15874 0 None None None 2025-09-16 00:45:44 UTC

Description TEJ RATHI 2023-12-20 07:26:15 UTC 
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling `load_pem_pkcs7_certificates` or `load_der_pkcs7_certificates` could lead to a NULL-pointer dereference and segfault. Exploitation of this vulnerability poses a serious risk of Denial of Service (DoS) for any application attempting to deserialize a PKCS7 blob/certificate. The consequences extend to potential disruptions in system availability and stability. This vulnerability has been patched in version 41.0.6.

https://github.com/pyca/cryptography/commit/f09c261ca10a31fe41b1262306db7f8f1da0e48a
https://github.com/pyca/cryptography/pull/9926
https://github.com/pyca/cryptography/security/advisories/GHSA-jfhm-5ghh-2f97
Comment 1 TEJ RATHI 2023-12-20 10:46:13 UTC 
Created python-cryptography tracking bugs for this issue:

Affects: fedora-all [bug 2255351]
Affects: openstack-rdo [bug 2255352]


Created python3-cryptography tracking bugs for this issue:

Affects: epel-all [bug 2255353]
Comment 8 Fedora Update System 2024-02-17 00:56:21 UTC 
FEDORA-2024-91f5df4002 (python-cryptography-41.0.7-1.fc39) has been pushed to the Fedora 39 stable repository.
If problem still persists, please make note of it in this bug report.
Comment 10 errata-xmlrpc 2024-04-02 19:30:14 UTC 
This issue has been addressed in the following products:

  Red Hat Ansible Automation Platform 2.4 for RHEL 9
  Red Hat Ansible Automation Platform 2.4 for RHEL 8

Via RHSA-2024:1640 https://access.redhat.com/errata/RHSA-2024:1640
Comment 11 errata-xmlrpc 2024-04-18 01:52:01 UTC 
This issue has been addressed in the following products:

  RHUI 4 for RHEL 8

Via RHSA-2024:1878 https://access.redhat.com/errata/RHSA-2024:1878
Comment 12 errata-xmlrpc 2024-04-30 10:04:12 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2024:2337 https://access.redhat.com/errata/RHSA-2024:2337
Comment 13 errata-xmlrpc 2024-05-22 09:45:35 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:3105 https://access.redhat.com/errata/RHSA-2024:3105
Comment 14 errata-xmlrpc 2024-06-10 18:36:58 UTC 
This issue has been addressed in the following products:

  Red Hat Ansible Automation Platform 2.4 for RHEL 9
  Red Hat Ansible Automation Platform 2.4 for RHEL 8

Via RHSA-2024:3781 https://access.redhat.com/errata/RHSA-2024:3781
Comment 16 errata-xmlrpc 2024-12-11 18:24:32 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Extended Update Support

Via RHSA-2024:10965 https://access.redhat.com/errata/RHSA-2024:10965
Comment 20 errata-xmlrpc 2025-08-06 00:24:51 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

Via RHSA-2025:13098 https://access.redhat.com/errata/RHSA-2025:13098
Comment 21 errata-xmlrpc 2025-08-06 00:27:54 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions

Via RHSA-2025:13102 https://access.redhat.com/errata/RHSA-2025:13102
Comment 22 errata-xmlrpc 2025-08-06 00:36:22 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2025:13101 https://access.redhat.com/errata/RHSA-2025:13101
Comment 23 errata-xmlrpc 2025-08-06 00:37:09 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2025:13100 https://access.redhat.com/errata/RHSA-2025:13100
Comment 24 errata-xmlrpc 2025-08-06 00:37:46 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Extended Update Support

Via RHSA-2025:13103 https://access.redhat.com/errata/RHSA-2025:13103
Comment 25 errata-xmlrpc 2025-08-06 00:43:38 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.6 Telecommunications Update Service

Via RHSA-2025:13104 https://access.redhat.com/errata/RHSA-2025:13104
Comment 26 errata-xmlrpc 2025-08-26 00:38:33 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2025:14553 https://access.redhat.com/errata/RHSA-2025:14553
Comment 28 errata-xmlrpc 2025-09-16 00:45:39 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2025:15874 https://access.redhat.com/errata/RHSA-2025:15874
Note You need to log in before you can comment on or make changes to this bug.