Critical NULL Pointer Dereference in Python Cryptography Package
Summary
UBUNTU-CVE-2024-26130: cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Affects python-cryptography versions < 41.0.7-4ubuntu0.1. Fixed in 41.0.7-4ubuntu0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'python-cryptography' package is a widely used library in Python that provides cryptographic primitives and recipes for developers. It enables secure communication and data protection through various cryptographic algorithms. However, certain versions of this package are vulnerable to a critical issue that can lead to application crashes, affecting the reliability of software that relies on it.
Vulnerability Detail
The vulnerability arises from the 'pkcs12.serialize_key_and_certificates' function, which can be exploited when a certificate with a mismatched public key is used alongside an 'encryption_algorithm' that has 'hmac_hash' set. This results in a NULL pointer dereference, causing the Python process to crash. The issue affects versions starting from 38.0.0 up to, but not including, 42.0.4. The ramifications include potential denial of service, as applications using the library may become unresponsive.
How To Fix
Minimum fixed version
41.0.7-4ubuntu0.1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-cryptographyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the 'pkcs12.serialize_key_and_certificates' function with mismatched keys until the package is updated. Additionally, consider implementing error handling to catch potential exceptions that may arise from this function.
Conclusion
The python-cryptography package has a critical vulnerability that can lead to application crashes due to a NULL pointer dereference. It is essential to update to the patched version to mitigate risks. Users are encouraged to monitor their applications for vulnerabilities using tools like Vulert.
See every vulnerability recorded for python-cryptography →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
Versions starting from 38.0.0 up to, but not including, 42.0.4 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploiting this vulnerability can lead to application crashes, resulting in denial of service for users relying on the affected software.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for python-cryptography.
