Critical Vulnerability in python3.12-cryptography: NULL Pointer Dereference
Summary
RLSA-2025:15608: Important: python3.12-cryptography security update. Affects python3.12-cryptography versions < 0:41.0.7-2.el9_6.1. Fixed in 0:41.0.7-2.el9_6.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The python3.12-cryptography package is a widely used library in Python for cryptographic operations, providing essential functionalities such as encryption, decryption, and secure data handling. It supports various cryptographic algorithms and protocols, making it a crucial component for applications requiring secure communications. However, this package is susceptible to a critical vulnerability that can lead to application crashes and potential data exposure.
Vulnerability Detail
The vulnerability arises from a NULL pointer dereference in the pkcs12.serialize_key_and_certificates function when it is invoked with a non-matching certificate and private key, along with an hmac_hash override. This flaw can be exploited to cause application crashes, leading to denial of service and potential data loss. The issue has been assigned CVE-2024-26130 and has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
0:41.0.7-2.el9_6.1
This is the first release that contains the fix.
sudo dnf update python3.12-cryptographyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the pkcs12.serialize_key_and_certificates function with mismatched certificates and private keys until the package is updated. This can help mitigate the risk of encountering the NULL pointer dereference issue.
Conclusion
The python3.12-cryptography package has a critical vulnerability that can lead to application crashes and potential data exposure. It is crucial to update to the patched version to mitigate these risks. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for python3.12-cryptography →
FAQ
The vulnerability is a NULL pointer dereference that occurs in the pkcs12.serialize_key_and_certificates function when provided with incompatible certificate and private key pairs.
Exploitation of this vulnerability can lead to application crashes and denial of service, potentially exposing sensitive data.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
Yes, a patch is available. Update the python3.12-cryptography package to version 0:41.0.7-2.el9_6.1 or later to resolve the issue.
Related vulnerabilities
Recent vulnerabilities recorded for python3.12-cryptography.
