cryptography vulnerable to NULL-dereference when loading PKCS7 certificates
Priority HIGH 66CWE-476Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 18 fixed, 5 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-476.
Summary
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling `load_pem_pkcs7_certificates` or `load_der_pkcs7_certificates` could lead to a NULL-pointer dereference and segfault. Exploitation of this vulnerability poses a serious risk of Denial of Service (DoS) for any application attempting to deserialize a PKCS7 blob/certificate. The consequences extend to potential disruptions in system availability and stability. This vulnerability has been patched in version 41.0.6.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00985 62nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial cryptography (pyca): 41.0.6cryptography (PyPI): 41.0.6Red Hat: 14 advisoriesRed Hat: 18 fixed, 5 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| pyca | cryptography | 3.1 to before 41.0.6 | 41.0.6 | Patch available | CNA |
| — | cryptography (PyPI) | 3.1 to before 41.0.6 | 41.0.6 | Patch available | GHSA-jfhm-5ghh-2f97 |
- cryptography Vendorpyca Affected 3.1 to before 41.0.6 Fixed in 41.0.6 Patch available CNA
- cryptography (PyPI) Vendor— Affected 3.1 to before 41.0.6 Fixed in 41.0.6 Patch available GHSA-jfhm-5ghh-2f97
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:cryptography.io:cryptography:*:*:*:*:*:python:*:* | 3.1 to before 41.0.6 | Vulnerable | Cryptography.io |
- cpe:2.3:a:cryptography.io:cryptography:*:*:*:*:*:python:*:* Versions 3.1 to before 41.0.6 Vulnerable ·Cryptography.io
Remediation
- Fix · CNA cryptography (pyca) Fixed in 41.0.6
- Fix · GHSA-jfhm-5ghh-2f97 cryptography (PyPI) Fixed in 41.0.6 Advisory →
Red Hat 14 advisories
- RHSA-2025:15874 Released 2025-09-16 · Red Hat rating Moderatepython-cryptography security update
- Red Hat Enterprise Linux BaseOS (v. 9) python-cryptography-36.0.1-5.el9_6, python3-cryptography-36.0.1-5.el9_6
- RHSA-2025:14553 Released 2025-08-26 · Red Hat rating Moderatepython-cryptography security update
- Red Hat Enterprise Linux BaseOS (v. 8) python-cryptography-3.2.1-8.el8_10, python3-cryptography-3.2.1-8.el8_10
- RHSA-2025:13104 Released 2025-08-06 · Red Hat rating Moderatepython-cryptography security update
- Red Hat Enterprise Linux BaseOS AUS (v.8.6) python-cryptography-3.2.1-5.1.el8_6.1, python3-cryptography-3.2.1-5.1.el8_6.1
- Red Hat Enterprise Linux BaseOS E4S (v.8.6) python-cryptography-3.2.1-5.1.el8_6.1, python3-cryptography-3.2.1-5.1.el8_6.1
- Red Hat Enterprise Linux BaseOS TUS (v.8.6) python-cryptography-3.2.1-5.1.el8_6.1, python3-cryptography-3.2.1-5.1.el8_6.1
Show 11 more Red Hat advisories
- RHSA-2025:13103 Released 2025-08-06 · Red Hat rating Moderatepython-cryptography security update
- Red Hat Enterprise Linux BaseOS EUS (v.9.4) python-cryptography-36.0.1-4.el9_4.1, python3-cryptography-36.0.1-4.el9_4.1
- RHSA-2025:13100 Released 2025-08-06 · Red Hat rating Moderatepython-cryptography security update
- Red Hat Enterprise Linux BaseOS E4S (v.8.8) python-cryptography-3.2.1-6.el8_8, python3-cryptography-3.2.1-6.el8_8
- Red Hat Enterprise Linux BaseOS TUS (v.8.8) python-cryptography-3.2.1-6.el8_8, python3-cryptography-3.2.1-6.el8_8
- RHSA-2025:13101 Released 2025-08-06 · Red Hat rating Moderatepython-cryptography security update
- Red Hat Enterprise Linux BaseOS E4S (v.9.2) python-cryptography-36.0.1-2.el9_2.1, python3-cryptography-36.0.1-2.el9_2.1
- RHSA-2025:13102 Released 2025-08-06 · Red Hat rating Moderatepython-cryptography security update
- Red Hat Enterprise Linux AppStream E4S (v.9.0) python-cryptography-36.0.1-1.el9_0.1, python3-cryptography-36.0.1-1.el9_0.1
- RHSA-2025:13098 Released 2025-08-06 · Red Hat rating Moderatepython-cryptography security update
- Red Hat Enterprise Linux BaseOS AUS (v.8.4) python-cryptography-3.2.1-4.el8_4.1, python3-cryptography-3.2.1-4.el8_4.1
- Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) python-cryptography-3.2.1-4.el8_4.1, python3-cryptography-3.2.1-4.el8_4.1
- RHSA-2024:10965 Released 2024-12-11 · Red Hat rating Moderatepython3.11-cryptography security update
- Red Hat Enterprise Linux AppStream EUS (v.8.8) python3.11-cryptography-37.0.2-5.el8_8.1
- RHSA-2024:3781 Released 2024-06-10 · Red Hat rating ModerateRed Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update
- Red Hat Ansible Automation Platform 2.4 for RHEL 8 automation-controller-venv-tower-4.5.7-1.el8ap, automation-hub-4.9.2-1.el8ap, python39-aiohttp-3.9.5-1.el8ap +25
- Red Hat Ansible Automation Platform 2.4 for RHEL 9 automation-controller-venv-tower-4.5.7-1.el9ap, automation-hub-4.9.2-1.el9ap, python-aiohttp-3.9.5-1.el9ap +25
- RHSA-2024:3105 Released 2024-05-22 · Red Hat rating Moderatepython3.11-cryptography security update
- Red Hat Enterprise Linux AppStream (v. 8) python3.11-cryptography-37.0.2-6.el8
- RHSA-2024:2337 Released 2024-04-30 · Red Hat rating Moderatepython3.11-cryptography security update
- Red Hat Enterprise Linux AppStream (v. 9) python3.11-cryptography-37.0.2-6.el9
- RHSA-2024:1878 Released 2024-04-18 · Red Hat rating ModerateRHUI 4.8 Release - Security Updates, Bug Fixes, and Enhancements
- RHUI 4 for RHEL 8 python-aiohttp-3.9.2-1.el8ui, python-cryptography-41.0.6-1.el8ui, python-django-4.2.11-1.el8ui +7
- RHSA-2024:1640 Released 2024-04-02 · Red Hat rating ModerateRed Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update
- Red Hat Ansible Automation Platform 2.4 for RHEL 8 automation-controller-venv-tower-4.5.5-2.el8ap, python39-aiohttp-3.9.3-1.el8ap, python39-django-4.2.11-1.el8ap +4
- Red Hat Ansible Automation Platform 2.4 for RHEL 9 automation-controller-venv-tower-4.5.5-2.el9ap, python-aiohttp-3.9.3-1.el9ap, python-django-4.2.11-1.el9ap +4
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Certification for Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 8 | Affected | No fix yet |
| Red Hat Quay 3 | Affected | No fix yet |
| Red Hat Software Collections | Affected | No fix planned: Will not fix |
| RHUI 4 for RHEL 8 | Fixed | RHSA-2024:1878 |
| Red Hat Ansible Automation Platform 2.4 for RHEL 8 | Fixed | RHSA-2024:1640, RHSA-2024:3781 |
| Red Hat Ansible Automation Platform 2.4 for RHEL 9 | Fixed | RHSA-2024:1640, RHSA-2024:3781 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2024:3105 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2024:2337 |
| Red Hat Enterprise Linux AppStream E4S (v.9.0) | Fixed | RHSA-2025:13102 |
| Red Hat Enterprise Linux AppStream EUS (v.8.8) | Fixed | RHSA-2024:10965 |
| Red Hat Enterprise Linux BaseOS (v. 8) | Fixed | RHSA-2025:14553 |
| Red Hat Enterprise Linux BaseOS (v. 9) | Fixed | RHSA-2025:15874 |
| Red Hat Enterprise Linux BaseOS AUS (v.8.4) | Fixed | RHSA-2025:13098 |
| Red Hat Enterprise Linux BaseOS AUS (v.8.6) | Fixed | RHSA-2025:13104 |
| Red Hat Enterprise Linux BaseOS E4S (v.8.6) | Fixed | RHSA-2025:13104 |
| Red Hat Enterprise Linux BaseOS E4S (v.8.8) | Fixed | RHSA-2025:13100 |
| Red Hat Enterprise Linux BaseOS E4S (v.9.2) | Fixed | RHSA-2025:13101 |
| Red Hat Enterprise Linux BaseOS EUS (v.9.4) | Fixed | RHSA-2025:13103 |
| Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) | Fixed | RHSA-2025:13098 |
| Red Hat Enterprise Linux BaseOS TUS (v.8.6) | Fixed | RHSA-2025:13104 |
| Red Hat Enterprise Linux BaseOS TUS (v.8.8) | Fixed | RHSA-2025:13100 |
Not affected: 8 products
- RHUI 4 for RHEL 8
- Red Hat Ansible Automation Platform 2
- Red Hat Ansible Automation Platform 2.4 for RHEL 8
- Red Hat Ansible Automation Platform 2.4 for RHEL 9
- Red Hat Ceph Storage 4
- Red Hat Discovery 1
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
Timeline
- 2026-10-02 Threatist record created from CVE-2023-49083
- 2026-10-03 Alias added: GHSA-jfhm-5ghh-2f97
References
Patch 2
Other 6
- https://lists.fedoraproject.org/archives/list/[email protected]/message/QMNTYMUGFJSDBYBU22FUYBHFRZODRKXV/
- https://github.com/pyca/cryptography
- https://github.com/pypa/advisory-database/tree/main/vulns/cryptography/PYSEC-2023-254.yaml
- https://lists.debian.org/debian-lts-announce/2024/10/msg00012.html
- https://lists.fedoraproject.org/archives/list/[email protected]/message/QMNTYMUGFJSDBYBU22FUYBHFRZODRKXV
- http://www.openwall.com/lists/oss-security/2023/11/29/2
More pyca vulnerabilities
- TI-2026-48588 python-cryptography: Duplicate self-signed intermediates can cause exponential path-building CVSS 4.0HIGH 8.7
- TI-2026-48587 python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees CVSS 4.0MEDIUM 6.9
- TI-2026-48586 cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing CVSS 4.0HIGH 8.2
Sources
- CVE-2023-49083 · CVE Program
- CVE-2023-49083 · NVD
- FIRST EPSS
- GHSA-jfhm-5ghh-2f97 · GitHub Advisory Database · CC BY 4.0
- CVE-2023-49083 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences