Skip to content
OpenAdvisories
Medium ALAS2023-2023-446 1 CVE

Moderate: python-cryptography security update (Amazon Linux 2023)

Published Dec 6, 2023 · Updated Dec 14, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-49083: cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling `load_pem_pkcs7_certificates` or `load_der_pkcs7_certificates` could lead to a NULL-pointer dereference and segfault. Exploitation of this vulnerability poses a serious risk of Denial of Service (DoS) for any application attempting to deserialize a PKCS7 blob/certificate. The consequences extend to potential disruptions in system availability and stability. This vulnerability has been patched in version 41.0.6.

Fixed packages 3

ReleasePackageFixed in
Amazon Linux · 2023 python-cryptography-debugsource 0:36.0.1-1.amzn2023.0.5
Amazon Linux · 2023 python3-cryptography 0:36.0.1-1.amzn2023.0.5
Amazon Linux · 2023 python3-cryptography-debuginfo 0:36.0.1-1.amzn2023.0.5

Vulnerabilities 1

  • Medium 5.9
    CVE-2023-49083

    cryptography vulnerable to NULL-dereference when loading PKCS7 certificates

    cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling `load_pem_pkcs7_certificates` or `load_der_pkcs7_certificates` could lead to a NULL-pointer dereference and segfault. Exploitation of this vulnerab…

    pyca cryptography py3-cassandra-medusa mitmproxy Debian Ubuntu Azure Linux Wolfi PyPI

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-49083.html