CVE-2023-49083: cryptography vulnerable to NULL-dereference when loading PKCS7 certificates
Summary
CVE-2023-49083: cryptography vulnerable to NULL-dereference when loading PKCS7 certificates. Affects cryptography versions >= 3.1, < 41.0.6. Fixed in 41.0.6. How to fix ↓
Also tracked for
- python-cryptography · Debian:11
The same CVE-2023-49083 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The cryptography package is an open-source library that provides cryptographic recipes and primitives for Python. It is commonly used for secure communication, data encryption, and digital signatures. The package supports various cryptographic algorithms and formats, including PKCS7 certificates. PKCS7 is a standard format for storing and exchanging certificates, such as X.509 certificates. However, a vulnerability has been discovered in the cryptography package that affects the loading of PKCS7 certificates.
Vulnerability Detail
The vulnerability in the cryptography package arises when calling the load_pem_pkcs7_certificates or load_der_pkcs7_certificates functions. This can lead to a NULL-pointer dereference and a segmentation fault (segfault). An attacker can exploit this vulnerability by providing a specially crafted PKCS7 certificate, causing the application to crash. The consequences of this vulnerability include potential disruptions in system availability and stability, leading to a Denial of Service (DoS) condition. The vulnerability has been assigned the identifier CVE-2023-49083.
How To Fix
Latest published version: 50.0.2 as of 22 Oct 2026
pip install --upgrade "cryptography==50.0.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
41.0.6
This is the first release that contains the fix.
pip install --upgrade "cryptography==41.0.6"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the cryptography package is not immediately feasible, a possible workaround is to avoid loading PKCS7 certificates using the vulnerable functions. Developers can implement additional input validation and error handling to mitigate the risk of NULL-pointer dereference. Here is an example of how to perform input validation before loading a PKCS7 certificate:
from cryptography.hazmat.primitives.serialization.pkcs7 import load_pem_pkcs7_certificates
pem_p7 = b"""
-----BEGIN PKCS7-----
MAsGCSqGSIb3DQEHAg==
-----END PKCS7-----
"""
if pem_p7.startswith(b'-----BEGIN PKCS7-----') and pem_p7.endswith(b'-----END PKCS7-----'):
load_pem_pkcs7_certificates(pem_p7)
else:
print('Invalid PKCS7 certificate')
Conclusion
The vulnerability in the cryptography package can lead to a Denial of Service (DoS) condition and system instability when loading PKCS7 certificates. It is crucial to update the package to version 41.0.6 or later to mitigate this vulnerability. Regularly updating all dependencies is also recommended to ensure the application is protected against the latest security threats. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for cryptography →
FAQ
The vulnerability can lead to a Denial of Service (DoS) condition, causing potential disruptions in system availability and stability. It can be exploited by an attacker to crash the application by providing a specially crafted PKCS7 certificate.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your Pipfile.lock and the playground will analyze it for open-source vulnerabilities, including this one.
Yes, the vulnerability can be fixed by updating the cryptography package to version 41.0.6 or later. It is recommended to regularly update all dependencies to ensure the latest security patches are applied.
If updating the cryptography package is not immediately feasible, a workaround is to avoid loading PKCS7 certificates using the vulnerable functions. Additional input validation and error handling can be implemented to mitigate the risk of NULL-pointer dereference.
You can find more information about this vulnerability, including its impact and technical details, in the GitHub Advisory Database at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/11/GHSA-jfhm-5ghh-2f97/GHSA-jfhm-5ghh-2f97.json
References
Related vulnerabilities
Recent vulnerabilities recorded for cryptography.
