Bug 2269617 (CVE-2024-26130) - CVE-2024-26130 python-cryptography: NULL pointer dereference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override
Summary: CVE-2024-26130 python-cryptography: NULL pointer dereference with pkcs12.seri...
Keywords:
Status: NEW
Alias: CVE-2024-26130
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2269618 2269619
Blocks: 2269615
TreeView+ depends on / blocked
 
Reported: 2024-03-14 22:17 UTC by Robb Gatica
Modified: 2024-06-10 18:37 UTC (History)
50 users (show)

Fixed In Version: cryptography 42.0.4
Doc Type: If docs needed, set a value
Doc Text:
A flaw was discovered in python-cryptography. A NULL pointer dereference can be triggered when a PKCS#12 key and certificate do not match. Specifically, if the pkcs12.serialize_key_and_certificates function is called with a non-matching certificate and private key and an encryption algorithm with hmac_hash set, the Python process may crash, leading to a denial of service.
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2024:3781 0 None None None 2024-06-10 18:37:33 UTC

Description Robb Gatica 2024-03-14 22:17:05 UTC 
If pkcs12.serialize_key_and_certificates is called with both:
- A certificate whose public key did not match the provided private key
- An encryption_algorithm with hmac_hash set (via PrivateFormat.PKCS12.encryption_builder().hmac_hash(...)

Then a NULL pointer dereference would occur, crashing the Python process. This has been resolved, and now a ValueError is properly raised.

Affected versions: >= 38.0.0, < 42.0.4

Patched in: https://github.com/pyca/cryptography/pull/10423

References:
https://github.com/pyca/cryptography/security/advisories/GHSA-6vqw-3v5j-54x4
https://github.com/pyca/cryptography/pull/10423
https://github.com/pyca/cryptography/commit/97d231672763cdb5959a3b191e692a362f1b9e55
Comment 1 Robb Gatica 2024-03-14 22:24:20 UTC 
Created python-cryptography tracking bugs for this issue:

Affects: fedora-all [bug 2269618]
Comment 9 errata-xmlrpc 2024-06-10 18:37:29 UTC 
This issue has been addressed in the following products:

  Red Hat Ansible Automation Platform 2.4 for RHEL 9
  Red Hat Ansible Automation Platform 2.4 for RHEL 8

Via RHSA-2024:3781 https://access.redhat.com/errata/RHSA-2024:3781
Note You need to log in before you can comment on or make changes to this bug.