CVE-2023-49083 json
cryptography vulnerable to NULL-dereference when loading PKCS7 certificates
published 2023-11-28 2 y ago modified 2026-09-10 1 mo ago also GHSA-jfhm-5ghh-2f97 , PYSEC-2023-254 , EUVD-2023-0060
- cvss
- 5.9
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.0%
- EPSS 1.0% chance of exploitation in 30 days, percentile 62%
- public exploits
- 0
- none known
Summary
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling `load_pem_pkcs7_certificates` or `load_der_pkcs7_certificates` could lead to a NULL-pointer dereference and segfault. Exploitation of this vulnerability poses a serious risk of Denial of Service (DoS) for any application attempting to deserialize a PKCS7 blob/certificate. The consequences extend to potential disruptions in system availability and stability. This vulnerability has been patched in version 41.0.6.
Patch / fix
- pypi cryptography 41.0.6
- cryptography.io cryptography 41.0.6
- python-cryptography Debian 12 38.0.4-3+deb12u1
- python-cryptography Debian 14, Debian 13 41.0.7-1
debian advisories DEBIAN-CVE-2023-49083
- python-cryptography Ubuntu 22.04 LTS 3.4.8-1ubuntu2.1
ubuntu advisories UBUNTU-CVE-2023-49083
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- python-cryptography RHEL 9 36.0.1-5.el9_6
- python3-cryptography RHEL 9 36.0.1-5.el9_6
- python-cryptography RHEL 8 3.2.1-8.el8_10
- python3-cryptography RHEL 8 3.2.1-8.el8_10
- receptor ansible automation platform inside 2.4, ansible automation platform developer 2.4, ansible automation platform 2.4 1.4.8-1.el8ap
- receptor ansible automation platform inside 2.4, ansible automation platform developer 2.4, ansible automation platform 2.4 1.4.8-1.el9ap
- python-idna ansible automation platform developer 2.4, ansible automation platform 2.4 3.7-1.el9ap
- receptorctl ansible automation platform inside 2.4, ansible automation platform developer 2.4, ansible automation platform 2.4 1.4.8-1.el8ap
red hat advisories RHSA-2025:15874RHSA-2025:14553RHSA-2025:13102RHSA-2025:13103RHSA-2025:13104RHSA-2025:13101
- python3-cryptography SLE Module for Basesystem 15 SP5, SLE Module for Basesystem 15 SP4, SLE Micro 5.5 +6 more 3.3.2-150400.23.1
- python-cryptography SLE Micro 5.2, SLE Micro 5.1 3.3.2-150200.22.1
- python-cryptography SLE Module for Public Cloud 15 SP1 3.3.2-150100.7.18.1
- python-cryptography SLE Module for Python 3 15 SP5, SLE Module for Python 3 15 SP4, openSUSE Leap 15.5 +1 more 41.0.3-150400.16.12.1
suse advisories SUSE-SU-2024:2375-1SUSE-SU-2023:4921-1SUSE-SU-2023:4844-1SUSE-SU-2023:4843-1SUSE-SU-2023:4842-1
- python-cryptography openSUSE Tumbleweed 50.0.0-1.1
- python-cryptography openSUSE Tumbleweed 41.0.7-1.1
opensuse advisories openSUSE-SU-2026:11468-1openSUSE-SU-2024:13472-1
- python3-cryptography AlmaLinux 9 36.0.1-5.el9_6
- python3-cryptography AlmaLinux 8 3.2.1-8.el8_10
- python3.11-cryptography AlmaLinux 8 37.0.2-6.el8
- python3.11-cryptography AlmaLinux 9 37.0.2-6.el9
almalinux advisories ALSA-2025:15874ALSA-2025:14553ALSA-2024:3105ALSA-2024:2337
- python-cryptography Rocky Linux 9 36.0.1-5.el9_6
- python-cryptography Rocky Linux 8 3.2.1-8.el8_10
- python3.11-cryptography Rocky Linux 8 37.0.2-6.el8
- python3.11-cryptography Rocky Linux 9 37.0.2-6.el9
rocky linux advisories RLSA-2025:15874RLSA-2025:14553RLSA-2024:3105RLSA-2024:2337
- python-cryptography CBL-Mariner 2.0 3.3.2-6
- python-cryptography Azure Linux 3.0 42.0.5-1
azure linux advisories AZL-32051AZL-35128
Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT
- github.com/pyca/cryptography@f09c261 commit
- github.com/pyca/cryptography#9926 pull request
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2023-49083 updated cvss 7.5
python-cryptography: NULL-dereference when loading PKCS7 certificates
-
Red Hat Certification for Red Hat Enterprise Linux 8 redhat-certification-baremetal-containeraffected: workaround, no fix available “Fix deferred”
-
Red Hat Enterprise Linux 7 python-cryptography, python2-cryptographyaffected: workaround, no fix planned “Out of support scope”
-
Red Hat Enterprise Linux 8 python-cryptography, python3-cryptography Red Hat Quay 3 quay/quay-rhel8affected: workaround, no fix available
-
Red Hat Software Collections rh-python38-python-cryptographyaffected: workaround, no fix planned “Will not fix”
-
Red Hat Ansible Automation Platform 2.4 for RHEL 8 python39-cryptography 42.0.5-1.el8ap, python3x-cryptography 42.0.5-1.el8ap, automation-controller-venv-tower 4.5.5-2.el8ap Red Hat Ansible Automation Platform 2.4 for RHEL 9 python-cryptography 42.0.5-1.el9ap, python3-cryptography 42.0.5-1.el9ap, automation-controller-venv-tower 4.5.5-2.el9apfixed: vendor fix RHSA-2024:3781
-
Red Hat Enterprise Linux AppStream (v. 8) python3.11-cryptography 37.0.2-6.el8fixed: vendor fix RHSA-2024:3105
-
Red Hat Enterprise Linux AppStream (v. 9) python3.11-cryptography 37.0.2-6.el9fixed: vendor fix RHSA-2024:2337
-
Red Hat Enterprise Linux AppStream E4S (v.9.0) python-cryptography 36.0.1-1.el9_0.1, python3-cryptography 36.0.1-1.el9_0.1fixed: vendor fix RHSA-2025:13102
show 13 moreshow fewer
-
Red Hat Enterprise Linux AppStream EUS (v.8.8) python3.11-cryptography 37.0.2-5.el8_8.1fixed: vendor fix RHSA-2024:10965
-
Red Hat Enterprise Linux BaseOS (v. 8) python-cryptography 3.2.1-8.el8_10, python3-cryptography 3.2.1-8.el8_10fixed: vendor fix RHSA-2025:14553
-
Red Hat Enterprise Linux BaseOS (v. 9) python-cryptography 36.0.1-5.el9_6, python3-cryptography 36.0.1-5.el9_6fixed: vendor fix RHSA-2025:15874
-
Red Hat Enterprise Linux BaseOS AUS (v.8.4) python-cryptography 3.2.1-4.el8_4.1, python3-cryptography 3.2.1-4.el8_4.1fixed: vendor fix RHSA-2025:13098
-
Red Hat Enterprise Linux BaseOS AUS (v.8.6) python-cryptography 3.2.1-5.1.el8_6.1, python3-cryptography 3.2.1-5.1.el8_6.1 Red Hat Enterprise Linux BaseOS E4S (v.8.6) python-cryptography 3.2.1-5.1.el8_6.1, python3-cryptography 3.2.1-5.1.el8_6.1fixed: vendor fix RHSA-2025:13104
-
Red Hat Enterprise Linux BaseOS E4S (v.8.8) python-cryptography 3.2.1-6.el8_8, python3-cryptography 3.2.1-6.el8_8fixed: vendor fix RHSA-2025:13100
-
Red Hat Enterprise Linux BaseOS E4S (v.9.2) python-cryptography 36.0.1-2.el9_2.1, python3-cryptography 36.0.1-2.el9_2.1fixed: vendor fix RHSA-2025:13101
-
Red Hat Enterprise Linux BaseOS EUS (v.9.4) python-cryptography 36.0.1-4.el9_4.1, python3-cryptography 36.0.1-4.el9_4.1fixed: vendor fix RHSA-2025:13103
-
Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) python-cryptography 3.2.1-4.el8_4.1, python3-cryptography 3.2.1-4.el8_4.1fixed: vendor fix RHSA-2025:13098
-
Red Hat Enterprise Linux BaseOS TUS (v.8.6) python-cryptography 3.2.1-5.1.el8_6.1, python3-cryptography 3.2.1-5.1.el8_6.1fixed: vendor fix RHSA-2025:13104
-
Red Hat Enterprise Linux BaseOS TUS (v.8.8) python-cryptography 3.2.1-6.el8_8, python3-cryptography 3.2.1-6.el8_8fixed: vendor fix RHSA-2025:13100
-
Red Hat RHUI 4 for RHEL 8 python-cryptography 41.0.6-1.el8ui, python3.11-cryptography 41.0.6-1.el8uifixed: vendor fix RHSA-2024:1878
-
Red Hat Ansible Automation Platform 2 python-ansible-compat, python3x-ansible-compat Red Hat Ansible Automation Platform 2.4 for RHEL 8 receptor 1.4.5-1.el8ap, receptor 1.4.8-1.el8ap, python39-idna 3.7-1.el8ap, python3x-idna 3.7-1.el8ap, receptorctl 1.4.5-1.el8ap, receptorctl 1.4.8-1.el8ap, +53 more Red Hat Ansible Automation Platform 2.4 for RHEL 9 receptor 1.4.5-1.el9ap, receptor 1.4.8-1.el9ap, python-idna 3.7-1.el9ap, python3-idna 3.7-1.el9ap, receptorctl 1.4.5-1.el9ap, receptorctl 1.4.8-1.el9ap, +53 more Red Hat Ceph Storage 4 ansible-runner-service Red Hat Discovery 1 discovery-server-container Red Hat Enterprise Linux 8 python3.12-cryptographynot affected: vulnerable code not present
+2 more productsfewer
Red Hat Enterprise Linux 9 python3.12-cryptography Red Hat RHUI 4 for RHEL 8 libsolv 0.7.22-6.el8ui, libcomps 0.1.18-8.el8ui, python-jq 1.6.0-3.el8ui, python-xlrd 2.0.1-8.el8ui, python-xlwt 1.3.0-6.el8ui, python-yarl 1.8.2-4.el8ui, +201 more
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 10 mo ago
Exploit prediction
0.98% chance of exploitation in the next 30 days, higher than 62% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/pyca/cryptography/security/advisories/GHSA-jfhm-5ghh-2f97 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.9 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| OSV | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| GitHub | 3.1 | 5.9 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | cryptography | >=3.1, <41.0.6 |
41.0.6 |
Affected products
- pyca cryptography
Classification
- Weakness
-
- CWE-476 NULL Pointer Dereference
References
-
github.com
/pyca/cryptography/pull/9926
web, issue-tracking, patch
-
github.com
/pyca/cryptography/commit/f09c261ca10a31fe41b1262306db7f8f1da0e48a
web, patch
-
github.com
/pyca/cryptography/security/advisories/GHSA-jfhm-5ghh-2f97
web, exploit, vendor-advisory, advisory
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/QMNTYMUGFJSDBYBU22FUYBHFRZODRKXV/
web
-
lists.debian.org
/debian-lts-announce/2024/10/msg00012.html
web
-
nvd.nist.gov
/vuln/detail/CVE-2023-49083
advisory
-
github.com
/pyca/cryptography
package
-
github.com
/pypa/advisory-database/tree/main/vulns/cryptography/PYSEC-2023-254.yaml
web
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/QMNTYMUGFJSDBYBU22FUYBHFRZODRKXV
web
-
openwall.com
/lists/oss-security/2023/11/29/2
web
Sources
- CVE List CVE-2023-49083
- GitHub Advisory GHSA-jfhm-5ghh-2f97
- NVD CVE-2023-49083
- OSV PYSEC-2023-254
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.