Skip to content
Commit 2d104f78 authored by Narpat Mali's avatar Narpat Mali Committed by Steve Sakoman
Browse files

python3-cryptography: fix CVE-2023-49083

cryptography is a package designed to expose cryptographic primitives
and recipes to Python developers. Calling `load_pem_pkcs7_certificates`
or `load_der_pkcs7_certificates` could lead to a NULL-pointer dereference
and segfault. Exploitation of this vulnerability poses a serious risk of
Denial of Service (DoS) for any application attempting to deserialize a
PKCS7 blob/certificate. The consequences extend to potential disruptions
in system availability and stability. This vulnerability has been patched
in version 41.0.6.

References:
https://nvd.nist.gov/vuln/detail/CVE-2023-49083
https://security-tracker.debian.org/tracker/CVE-2023-49083



Signed-off-by: default avatarNarpat Mali <narpat.mali@windriver.com>
Signed-off-by: default avatarSteve Sakoman <steve@sakoman.com>
parent 9c21b08c
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment