Launch Week Day 1: Announcing Security Design Review
HIGH 7.5 PyPI

cryptography NULL pointer dereference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override

GHSA-6vqw-3v5j-54x4 · CVE-2024-26130 · PYSEC-2024-225

Published · Modified

Description

If pkcs12.serialize_key_and_certificates is called with both:

  1. A certificate whose public key did not match the provided private key
  2. An encryption_algorithm with hmac_hash set (via PrivateFormat.PKCS12.encryption_builder().hmac_hash(...)

Then a NULL pointer dereference would occur, crashing the Python process.

This has been resolved, and now a ValueError is properly raised.

Patched in https://github.com/pyca/cryptography/pull/10423

Ready to move

Start Securing

Free, no credit card | First findings in minutes