Moderate: python3.11-cryptography security update
Summary
ALSA-2024:3105: Moderate: python3.11-cryptography security update. Affects python3.11-cryptography versions < 37.0.2-6.el8. Fixed in 37.0.2-6.el8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The python3.11-cryptography package is a part of the AlmaLinux 8 ecosystem. It includes the Python Cryptographic Authority's (PyCA's) cryptography library, which offers cryptographic primitives and recipes for Python developers. This library is widely used for implementing secure communication, encryption, and authentication in Python applications.
Vulnerability Detail
The vulnerability identified in the python3.11-cryptography package is a NULL-dereference issue when loading PKCS7 certificates. This vulnerability is tracked as CVE-2023-49083. A NULL-dereference occurs when a program attempts to access or dereference a null pointer, leading to a crash or unexpected behavior. In this case, an attacker could exploit this vulnerability to cause a denial-of-service (DoS) condition or potentially execute arbitrary code. The impact of this vulnerability depends on the context in which the cryptography library is used.
How To Fix
Minimum fixed version
37.0.2-6.el8
This is the first release that contains the fix.
sudo dnf update python3.11-cryptographyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the python3.11-cryptography package in AlmaLinux 8 is vulnerable to a NULL-dereference issue when loading PKCS7 certificates. This vulnerability can have varying impacts depending on the usage of the cryptography library. To mitigate this vulnerability, it is recommended to update the package to version 37.0.2-6.el8 or later. Promptly applying security updates is crucial to ensure the security of your system. If you need further assistance or support in addressing this vulnerability, you can reach out to DevNack.com.
See every vulnerability recorded for python3.11-cryptography →
FAQ
The impact of this vulnerability can vary depending on the usage of the cryptography library. In some cases, it can lead to a denial-of-service (DoS) condition or allow an attacker to execute arbitrary code.
At the time of this advisory, there are no known public exploits available for this vulnerability. However, it is always recommended to apply security updates promptly to mitigate potential risks.
No, only versions prior to 37.0.2-6.el8 are affected by this vulnerability. It is crucial to update to the fixed version to ensure the security of your system.
Yes, this vulnerability can be exploited remotely if the affected application is exposed to untrusted input or network connections. It is important to update the package to prevent potential attacks.
You can find more information about this vulnerability, including the Common Vulnerabilities and Exposures (CVE) identifier, on the CVE page listed in the References section of the AlmaLinux Release Notes.
Related vulnerabilities
Recent vulnerabilities recorded for python3.11-cryptography.
