Vulnerability · Published Feb 21, 2024 · Assigned by GitHub_M
CVE-2024-26130cryptography NULL pointer deference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override
High 7.5
In plain English
A high-severity null pointer dereference in cryptography from pyca. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Starting in version 38.0.0 and prior to version 42.0.4, if `pkcs12.serialize_key_and_certificates` is called with both a certificate whose public key did not match the provided private key and an `encryption_algorithm` with `hmac_hash` set (via `PrivateFormat.PKCS12.encryption_builder().hmac_hash(...)`, then a NULL pointer dereference would occur, crashing the Python process. This has been resolved in version 42.0.4, the first version in which a `ValueError` is properly raised.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:9 | python3.12-cryptography | 41.0.7-2.el9_6.1 | ALSA-2025:15608 |
| Debian:12 | python-cryptography | 38.0.4-3+deb12u1 | DEBIAN-CVE-2024-26130 |
| Debian:13 | python-cryptography | 42.0.5-1 | DEBIAN-CVE-2024-26130 |
| Debian:14 | python-cryptography | 42.0.5-1 | DEBIAN-CVE-2024-26130 |
| PyPI | cryptography | 42.0.4 | PYSEC-2024-225 |
| PyPI | cryptography | 42.0.4 | GHSA-6vqw-3v5j-54x4 |
| Rocky Linux:9 | python3.12-cryptography | 0:41.0.7-2.el9_6.1 | RLSA-2025:15608 |
| Ubuntu:22.04:LTS | python-cryptography | 3.4.8-1ubuntu2.2 | USN-6673-1 |
| Ubuntu:24.04:LTS | python-cryptography | 41.0.7-4ubuntu0.1 | USN-6673-3 |
| Ubuntu:24.04:LTS | python-cryptography | 41.0.7-4ubuntu0.1 | UBUNTU-CVE-2024-26130 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| pyca | cryptography | >= 38.0.0, < 42.0.4 |
Weakness: CWE-476 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/pyca/cryptography/security/advisories/GHSA-6vqw-3v5j-54x4 x_refsource_CONFIRM
- https://github.com/pyca/cryptography/pull/10423 x_refsource_MISC
- https://github.com/pyca/cryptography/commit/97d231672763cdb5959a3b191e692a362f1b9e55 x_refsource_MISC