x/vulndb: potential Go vuln in github.com/pyca/cryptography: CVE-2023-49083 #2367
Description
CVE-2023-49083 references github.com/pyca/cryptography, which may be a Go module.
Description:
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling load_pem_pkcs7_certificates or load_der_pkcs7_certificates could lead to a NULL-pointer dereference and segfault. Exploitation of this vulnerability poses a serious risk of Denial of Service (DoS) for any application attempting to deserialize a PKCS7 blob/certificate. The consequences extend to potential disruptions in system availability and stability. This vulnerability has been patched in version 41.0.6.
References:
- NIST: https://nvd.nist.gov/vuln/detail/CVE-2023-49083
- JSON: https://github.com/CVEProject/cvelist/tree/2806b5b39e538168df8b943675064fc9c71e8aa1/2023/49xxx/CVE-2023-49083.json
- advisory: GHSA-jfhm-5ghh-2f97
- fix: Fixed crash when loading a PKCS#7 bundle with no certificates pyca/cryptography#9926
- fix: pyca/cryptography@f09c261
- Imported by: https://pkg.go.dev/github.com/pyca/cryptography?tab=importedby
Cross references:
- Module github.com/pyca/cryptography appears in issue x/vulndb: potential Go vuln in github.com/pyca/cryptography: CVE-2020-25659 #430 NOT_GO_CODE
- Module github.com/pyca/cryptography appears in issue x/vulndb: potential Go vuln in github.com/pyca/cryptography: CVE-2020-36242 #431 NOT_GO_CODE
- Module github.com/pyca/cryptography appears in issue x/vulndb: potential Go vuln in github.com/pyca/cryptography: CVE-2023-23931 #1536 NOT_GO_CODE
- Module github.com/pyca/cryptography appears in issue x/vulndb: potential Go vuln in github.com/pyca/cryptography: CVE-2023-38325 #1920 NOT_GO_CODE
See doc/triage.md for instructions on how to triage this report.
modules:
- module: github.com/pyca/cryptography
vulnerable_at: 0.0.0-20231129023145-11e92173875d
packages:
- package: cryptography
cves:
- CVE-2023-49083
references:
- advisory: https://github.com/pyca/cryptography/security/advisories/GHSA-jfhm-5ghh-2f97
- fix: https://github.com/pyca/cryptography/pull/9926
- fix: https://github.com/pyca/cryptography/commit/f09c261ca10a31fe41b1262306db7f8f1da0e48a