Skip to content
OpenAdvisories
High USN-6673-3 1 CVE

python-cryptography vulnerability

Published May 27, 2024 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

USN-6673-1 provided a security update for python-cryptography.
This update provides the corresponding update for Ubuntu 24.04 LTS.

Original advisory details:

It was discovered that python-cryptography incorrectly handled memory
operations when processing mismatched PKCS#12 keys. A remote attacker could
possibly use this issue to cause python-cryptography to crash, leading to a
denial of service. This issue only affected Ubuntu 23.10. (CVE-2024-26130)

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 24.04 LTS 24.04:LTS python-cryptography 41.0.7-4ubuntu0.1

Vulnerabilities 1

  • High 7.5
    CVE-2024-26130

    cryptography NULL pointer deference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override

    cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Starting in version 38.0.0 and prior to version 42.0.4, if `pkcs12.serialize_key_and_certificates` is called with both a certificate whose public key did n…

    pyca cryptography py3-cassandra-medusa kubeflow-pipelines Debian Ubuntu Wolfi PyPI

References

  • report
    https://ubuntu.com/security/CVE-2024-26130