Critical Denial of Service Vulnerability in Python Cryptography Package
Summary
UBUNTU-CVE-2023-49083: cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Affects python-cryptography versions < 3.4.8-1ubuntu2.1. Fixed in 3.4.8-1ubuntu2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Python Cryptography package is a widely used library that provides cryptographic primitives and recipes to Python developers. It enables secure data transmission and storage through various encryption techniques. However, it has been identified that certain functions within this library can lead to severe vulnerabilities, particularly when handling PKCS7 blobs or certificates.
Vulnerability Detail
This vulnerability, identified as CVE-2023-49083, arises from the improper handling of PKCS7 certificates in the functions load_pem_pkcs7_certificates and load_der_pkcs7_certificates. When these functions are called, they may result in a NULL-pointer dereference, leading to a segmentation fault (segfault). This can cause applications to crash, resulting in a Denial of Service (DoS) condition. The implications of this vulnerability are significant, as it can disrupt system availability and stability, affecting any application that attempts to deserialize a PKCS7 blob or certificate.
How To Fix
Minimum fixed version
3.4.8-1ubuntu2.1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-cryptographyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, avoid using the functions load_pem_pkcs7_certificates and load_der_pkcs7_certificates until the package has been updated to the patched version. This can help mitigate the risk of encountering a segfault.
Conclusion
The CVE-2023-49083 vulnerability in the Python Cryptography package poses a significant risk of Denial of Service due to improper handling of PKCS7 certificates. It is crucial to update to the patched version to protect your applications from potential crashes and service disruptions.
See every vulnerability recorded for python-cryptography →
FAQ
CVE-2023-49083 is a vulnerability in the Python Cryptography package that can lead to a Denial of Service due to a NULL-pointer dereference.
Exploitation of this vulnerability can cause your application to crash, leading to service disruptions and potential downtime.
Yes, the vulnerability has been patched in version 3.4.8-1ubuntu2.1 of the Python Cryptography package.
As a workaround, refrain from using the affected functions until you can apply the update.
You can use Vulert, which allows you to monitor and alert for open-source vulnerabilities in your software using a manifest file. Visit Vulert Scanner to check your application without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for python-cryptography.
