CVE-2023-49083

NULL-pointer dereference in cryptography 41.0.5 load_pem_pkcs7_certificates and load_der_pkcs7_certificates functions

• CVSS 7.5
• CWE-476 NULL Pointer Dereference
• Design Defects
• Remote

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling `load_pem_pkcs7_certificates` or `load_der_pkcs7_certificates` could lead to a NULL-pointer dereference and segfault. Exploitation of this vulnerability poses a serious risk of Denial of Service (DoS) for any application attempting to deserialize a PKCS7 blob/certificate. The consequences extend to potential disruptions in system availability and stability. This vulnerability has been patched in version 41.0.6.

CVE

CVE-2023-49083

CWE

CWE-476 NULL Pointer Dereference

CVSS base score

7.5

Published

2023-11-29

OWASP

A06 Vulnerable and Outdated Components

Orthogonal defect classification

Interface

Code defect classification

Extraneous Interface

Category

Design Defects

Subcategory

Inadequate Error Handling

Accessibility scope

Remote

Impact

Denial of Service (DoS)

Fixed by upgrading

Yes

Solution

Upgrade to version 41.0.6 of the cryptography package

from cryptography.hazmat.backends import default_backend
from cryptography.hazmat.primitives import serialization

def load_pkcs7_certificates(data):
    certificates = serialization.load_pem_pkcs7_certificates(data, default_backend())
    return certificates

pem_data = b"""-----BEGIN PKCS7-----\n...\n-----END PKCS7-----"""
certs = load_pkcs7_certificates(pem_data)
print("Certificates loaded:", certs)

from cryptography.hazmat.primitives import serialization
from cryptography.exceptions import UnsupportedAlgorithm

def load_pkcs7_certificates(data):
    try:
        if not data.startswith(b"-----BEGIN PKCS7-----"):
            raise ValueError("Invalid PKCS7 format")
        certificates = serialization.load_pem_pkcs7_certificates(data)
        return certificates
    except (ValueError, UnsupportedAlgorithm) as e:
        return []

pem_data = b"""-----BEGIN PKCS7-----\nMIIB...FAKE...==\n-----END PKCS7-----"""
certs = load_pkcs7_certificates(pem_data)
print("Certificates loaded:", certs)

@misc{vaitp:cve202349083,
  title        = {{NULL-pointer dereference in cryptography 41.0.5 load_pem_pkcs7_certificates and load_der_pkcs7_certificates functions}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2023},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2023-49083},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2023-49083/}}
}