CVE-2023-49083
low-risk
Published 2023-11-29
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling `load_pem_pkcs7_certificates` or `load_der_pkcs7_certificates` could lead to a NULL-pointer dereference and segfault. Exploitation of this vulnerability poses a serious risk of Denial of Service (DoS) for any application attempting to deserialize a PKCS7 blob/certificate. The consequences extend to potential disruptions in system availability and stability. This vulnerability has been patched in version 41.0.6.
Do I need to act?
-
0.93% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
5
CVSS 5.9/10
Medium
NETWORK
/ HIGH complexity
Affected Products (1)
Cryptography
Affected Vendors
References (9)
Issue Tracking
https://github.com/pyca/cryptography/pull/9926
Issue Tracking
https://github.com/pyca/cryptography/pull/9926
26
/ 100
low-risk
Severity
18/34 · Moderate
Exploitability
3/34 · Minimal
Exposure
5/34 · Minimal