CVE-2023-49083: cryptography vulnerable to NULL-dereference when loading PKCS7 certificates
(updated )
Calling load_pem_pkcs7_certificates or load_der_pkcs7_certificates could lead to a NULL-pointer dereference and segfault.
References
- github.com/advisories/GHSA-jfhm-5ghh-2f97
- github.com/pyca/cryptography
- github.com/pyca/cryptography/commit/f09c261ca10a31fe41b1262306db7f8f1da0e48a
- github.com/pyca/cryptography/pull/9926
- github.com/pyca/cryptography/security/advisories/GHSA-jfhm-5ghh-2f97
- github.com/pypa/advisory-database/tree/main/vulns/cryptography/PYSEC-2023-254.yaml
- lists.debian.org/debian-lts-announce/2024/10/msg00012.html
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QMNTYMUGFJSDBYBU22FUYBHFRZODRKXV
- nvd.nist.gov/vuln/detail/CVE-2023-49083
Code Behaviors & Features
Detect and mitigate CVE-2023-49083 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →