Critical Security Update for python3.12-cryptography: NULL Pointer Dereference Vulnerability
Summary
ALSA-2025:15608: Important: python3.12-cryptography security update. Affects python3.12-cryptography versions < 41.0.7-2.el9_6.1. Fixed in 41.0.7-2.el9_6.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python3.12-cryptography is a widely used library in Python that provides cryptographic recipes and primitives to developers. It supports various encryption algorithms and is essential for secure data transmission and storage. However, a recent vulnerability has been identified that could lead to severe security issues if not addressed promptly.
Vulnerability Detail
The vulnerability arises from a NULL pointer dereference in the python-cryptography library, specifically in the pkcs12.serialize_key_and_certificates function. This issue occurs when the function is called with a non-matching certificate and private key while using an hmac_hash override. If exploited, this could lead to application crashes or unexpected behavior, potentially exposing sensitive data or allowing unauthorized access.
How To Fix
Minimum fixed version
41.0.7-2.el9_6.1
This is the first release that contains the fix.
sudo dnf update python3.12-cryptographyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, avoid using the pkcs12.serialize_key_and_certificates function with mismatched certificates and private keys. Ensure that the inputs provided to this function are valid and compatible to prevent triggering the vulnerability.
Conclusion
The python3.12-cryptography library has a critical vulnerability that requires immediate attention. By updating to the patched version, users can protect their applications from potential exploitation. It is essential to remain vigilant and monitor for any further updates or vulnerabilities.
See every vulnerability recorded for python3.12-cryptography →
FAQ
The vulnerability is a NULL pointer dereference that can occur when using the pkcs12.serialize_key_and_certificates function with incompatible inputs.
Exploitation of this vulnerability could lead to application crashes, unexpected behavior, and potential exposure of sensitive data.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Yes, a patch is available in version 41.0.7-2.el9_6.1 of the python3.12-cryptography package. Updating to this version will resolve the issue.
If an immediate update is not possible, ensure that you do not use the vulnerable function with mismatched inputs as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for python3.12-cryptography.
