Skip to content

NULL pointer deference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override

Moderate
alex published GHSA-6vqw-3v5j-54x4 Feb 21, 2024

Package

pip cryptography (pip)

Affected versions

>=38.0.0

Patched versions

>=42.0.4

Description

If pkcs12.serialize_key_and_certificates is called with both:

  1. A certificate whose public key did not match the provided private key
  2. An encryption_algorithm with hmac_hash set (via PrivateFormat.PKCS12.encryption_builder().hmac_hash(...)

Then a NULL pointer dereference would occur, crashing the Python process.

This has been resolved, and now a ValueError is properly raised.

Patched in #10423

Severity

Moderate

CVE ID

CVE-2024-26130

Weaknesses

NULL Pointer Dereference

A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit. Learn more on MITRE.

Credits