CVE-2024-26130: cryptography NULL pointer dereference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override
(updated )
If pkcs12.serialize_key_and_certificates is called with both:
- A certificate whose public key did not match the provided private key
- An
encryption_algorithmwithhmac_hashset (viaPrivateFormat.PKCS12.encryption_builder().hmac_hash(...)
Then a NULL pointer dereference would occur, crashing the Python process.
This has been resolved, and now a ValueError is properly raised.
Patched in https://github.com/pyca/cryptography/pull/10423
References
- github.com/advisories/GHSA-6vqw-3v5j-54x4
- github.com/pyca/cryptography
- github.com/pyca/cryptography/commit/97d231672763cdb5959a3b191e692a362f1b9e55
- github.com/pyca/cryptography/pull/10423
- github.com/pyca/cryptography/security/advisories/GHSA-6vqw-3v5j-54x4
- github.com/pypa/advisory-database/tree/main/vulns/cryptography/PYSEC-2024-225.yaml
- nvd.nist.gov/vuln/detail/CVE-2024-26130
Code Behaviors & Features
Detect and mitigate CVE-2024-26130 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →