Home

CVE-2023-49083

Description

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling load_pem_pkcs7_certificates or load_der_pkcs7_certificates could lead to a null-pointer dereference and segfault. Exploitation of this vulnerability poses a serious risk of Denial of Service (DoS) for any application attempting to deserialize a PKCS7 blob/certificate. The consequences extend to potential disruptions in system availability and stability. This vulnerability has been patched in version 41.0.6.

Risk Information

Base Score
7.5
MODERATE
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score
Exploitation Probability
1.255

Associated Vulnerability

VulnerabilityOS Platform
Multiple vulnerabilities are fixed in Duo Security Authentication Proxy 6.3.0Windows
Multiple vulnerabilities are fixed in Duo Security Authentication Proxy (6.2.0)Windows
Multiple vulnerabilities are fixed in Duo Security Authentication Proxy (6.1.0)Windows
Multiple vulnerabilities are fixed in Duo Security Authentication Proxy (6.3.0)Windows
Multiple vulnerabilities are fixed in Duo Security Authentication Proxy (6.0.2)Windows
Multiple vulnerabilities are fixed in Duo Security Authentication Proxy (6.0.1)Windows
Multiple Vulnerabilities are affected in IBM Cognos Analytics 11.2.4Windows
Multiple Vulnerabilities are affected in IBM Cognos Analytics 12.0.3Windows
Multiple Vulnerabilities are affected in IBM Planning Analytics Local 2.0Windows
Multiple Vulnerabilities are affected in IBM Planning Analytics Local 2.1Windows
Vulnerabilities CVE-2023-49083 are fixed in Python-cryptography 41.0.6Windows
Cryptography Python library (USN-6539-1) python-cryptography_2.8-3ubuntu0.2_amd64.debLinux
Cryptography Python library (USN-6539-1) python3-cryptography_2.8-3ubuntu0.2_amd64.debLinux
Cryptography Python library (USN-6539-1) python3-cryptography_3.4.8-1ubuntu2.1_i386.debLinux
Cryptography Python library (USN-6539-1) python3-cryptography_3.4.8-1ubuntu2.1_amd64.debLinux
Cryptography Python library (USN-6539-1) python3-cryptography_38.0.4-2ubuntu0.1_amd64.debLinux
Cryptography Python library (USN-6539-1) python3-cryptography_38.0.4-4ubuntu0.23.10.1_amd64.debLinux
SUSE-SU-2023:4843-1(Basesystem Module 15-SP4) python3-cryptography-3.3.2-150400.23.1.x86_64.rpmLinux
SUSE-SU-2023:4843-1(Basesystem Module 15-SP5) python3-cryptography-3.3.2-150400.23.1.x86_64_15_SP5.rpmLinux
SUSE-SU-2023:4843-1(Basesystem Module 15-SP4) python3-cryptography-debuginfo-3.3.2-150400.23.1.x86_64.rpmLinux
SUSE-SU-2023:4843-1(Basesystem Module 15-SP5) python3-cryptography-debuginfo-3.3.2-150400.23.1.x86_64_15_SP5.rpmLinux
SUSE-SU-2023:4843-1(Basesystem Module 15-SP4) python3-cryptography-debugsource-3.3.2-150400.23.1.x86_64.rpmLinux
SUSE-SU-2023:4843-1(Basesystem Module 15-SP5) python3-cryptography-debugsource-3.3.2-150400.23.1.x86_64_15_SP5.rpmLinux
Python3.11-cryptography update (ELSA-2024-12078) python3.11-cryptography-37.0.2-5.0.1.el9.x86_64.rpmLinux
Python3.11-cryptography update (ELSA-2024-12078) python3.11-cryptography-37.0.2-5.0.1.el8.x86_64.rpmLinux
Python3-cryptography update (ELSA-2024-12079) python3-cryptography-36.0.1-4.0.1.el9.x86_64.rpmLinux
Python3-cryptography update (ELSA-2024-12079) python3-cryptography-3.2.1-6.0.1.el8.x86_64.rpmLinux
python3.11 update (TU-CESAS-0004) python3.11-cryptography-37.0.2-6.el8.x86_64.rpmLinux
python3 update (TU-CESAS-0024) python3-jinja2-2.10.1-4.el8.noarch.rpmLinux
python3.12 update (TU-CESAS-0024) python3.12-cryptography-41.0.7-1.el8.x86_64.rpmLinux
Python36-cryptography update (ELSA-2024-12234) python36-cryptography-3.2.1-1.0.1.el7.x86_64.rpmLinux
Python36-cryptography update (ELSA-2024-19480) python36-cryptography-3.2.1-1.0.1.el7.x86_64.rpmLinux
(RHSA-2024:2337)Moderate: security update python3.11-cryptography-37.0.2-6.el9.x86_64.rpmLinux
(RHSA-2024:2337)Moderate: security update python3.11-cryptography-debuginfo-37.0.2-6.el9.x86_64.rpmLinux
(RHSA-2024:2337)Moderate: security update python3.11-cryptography-debugsource-37.0.2-6.el9.x86_64.rpmLinux
Python3.11-cryptography update (ELSA-2024-2337) python3.11-cryptography-37.0.2-6.el9.x86_64.rpmLinux
(RHSA-2024:3105)Moderate: security update python3.11-cryptography-37.0.2-6.el8.x86_64.rpmLinux
(RHSA-2024:3105)Moderate: security update python3.11-cryptography-debuginfo-37.0.2-6.el8.x86_64.rpmLinux
(RHSA-2024:3105)Moderate: security update python3.11-cryptography-debugsource-37.0.2-6.el8.x86_64.rpmLinux
Python39 update (ELSA-2024-2985) python39-3.9.18-3.module+el8.10.0+90269+2fa22b99.x86_64.rpmLinux
Python39-PyMySQL update (ELSA-2024-2985) python39-PyMySQL-0.10.1-2.module+el8.9.0+90016+9c2d6573.noarch.rpmLinux
Python39-cffi update (ELSA-2024-2985) python39-cffi-1.14.3-2.module+el8.9.0+90016+9c2d6573.x86_64.rpmLinux
Python39-chardet update (ELSA-2024-2985) python39-chardet-3.0.4-19.module+el8.9.0+90016+9c2d6573.noarch.rpmLinux
Python39-cryptography update (ELSA-2024-2985) python39-cryptography-3.3.1-3.0.1.module+el8.10.0+90269+2fa22b99.x86_64.rpmLinux
Python39-devel update (ELSA-2024-2985) python39-devel-3.9.18-3.module+el8.10.0+90269+2fa22b99.x86_64.rpmLinux
Python39-idle update (ELSA-2024-2985) python39-idle-3.9.18-3.module+el8.10.0+90269+2fa22b99.x86_64.rpmLinux
Python39-idna update (ELSA-2024-2985) python39-idna-2.10-3.module+el8.9.0+90016+9c2d6573.noarch.rpmLinux
Python39-libs update (ELSA-2024-2985) python39-libs-3.9.18-3.module+el8.10.0+90269+2fa22b99.x86_64.rpmLinux
Python39-lxml update (ELSA-2024-2985) python39-lxml-4.6.5-1.module+el8.9.0+90016+9c2d6573.x86_64.rpmLinux
Python39-mod_wsgi update (ELSA-2024-2985) python39-mod_wsgi-4.7.1-7.module+el8.9.0+90016+9c2d6573.x86_64.rpmLinux
Python39-numpy update (ELSA-2024-2985) python39-numpy-1.19.4-3.module+el8.9.0+90016+9c2d6573.x86_64.rpmLinux
Python39-numpy-doc update (ELSA-2024-2985) python39-numpy-doc-1.19.4-3.module+el8.9.0+90016+9c2d6573.noarch.rpmLinux
Python39-numpy-f2py update (ELSA-2024-2985) python39-numpy-f2py-1.19.4-3.module+el8.9.0+90016+9c2d6573.x86_64.rpmLinux
Python39-pip update (ELSA-2024-2985) python39-pip-20.2.4-9.module+el8.10.0+90269+2fa22b99.noarch.rpmLinux
Python39-pip-wheel update (ELSA-2024-2985) python39-pip-wheel-20.2.4-9.module+el8.10.0+90269+2fa22b99.noarch.rpmLinux
Python39-ply update (ELSA-2024-2985) python39-ply-3.11-10.module+el8.9.0+90016+9c2d6573.noarch.rpmLinux
Python39-psutil update (ELSA-2024-2985) python39-psutil-5.8.0-4.module+el8.9.0+90016+9c2d6573.x86_64.rpmLinux
Python39-psycopg2 update (ELSA-2024-2985) python39-psycopg2-2.8.6-3.module+el8.10.0+90269+2fa22b99.x86_64.rpmLinux
Python39-psycopg2-doc update (ELSA-2024-2985) python39-psycopg2-doc-2.8.6-3.module+el8.10.0+90269+2fa22b99.x86_64.rpmLinux
Python39-psycopg2-tests update (ELSA-2024-2985) python39-psycopg2-tests-2.8.6-3.module+el8.10.0+90269+2fa22b99.x86_64.rpmLinux
Python39-pycparser update (ELSA-2024-2985) python39-pycparser-2.20-3.module+el8.9.0+90016+9c2d6573.noarch.rpmLinux
Python39-pysocks update (ELSA-2024-2985) python39-pysocks-1.7.1-4.module+el8.9.0+90016+9c2d6573.noarch.rpmLinux
Python39-pyyaml update (ELSA-2024-2985) python39-pyyaml-5.4.1-1.module+el8.9.0+90016+9c2d6573.x86_64.rpmLinux
Python39-requests update (ELSA-2024-2985) python39-requests-2.25.0-3.module+el8.9.0+90016+9c2d6573.noarch.rpmLinux
Python39-rpm-macros update (ELSA-2024-2985) python39-rpm-macros-3.9.18-3.module+el8.10.0+90269+2fa22b99.noarch.rpmLinux
Python39-scipy update (ELSA-2024-2985) python39-scipy-1.5.4-5.module+el8.9.0+90016+9c2d6573.x86_64.rpmLinux
Python39-setuptools update (ELSA-2024-2985) python39-setuptools-50.3.2-5.module+el8.10.0+90269+2fa22b99.noarch.rpmLinux
Python39-setuptools-wheel update (ELSA-2024-2985) python39-setuptools-wheel-50.3.2-5.module+el8.10.0+90269+2fa22b99.noarch.rpmLinux
Python39-six update (ELSA-2024-2985) python39-six-1.15.0-3.module+el8.9.0+90016+9c2d6573.noarch.rpmLinux
Python39-test update (ELSA-2024-2985) python39-test-3.9.18-3.module+el8.10.0+90269+2fa22b99.x86_64.rpmLinux
Python39-tkinter update (ELSA-2024-2985) python39-tkinter-3.9.18-3.module+el8.10.0+90269+2fa22b99.x86_64.rpmLinux
Python39-toml update (ELSA-2024-2985) python39-toml-0.10.1-5.module+el8.9.0+90016+9c2d6573.noarch.rpmLinux
Python39-urllib3 update (ELSA-2024-2985) python39-urllib3-1.25.10-5.module+el8.10.0+90269+2fa22b99.noarch.rpmLinux
Python39-wheel update (ELSA-2024-2985) python39-wheel-0.35.1-4.module+el8.9.0+90016+9c2d6573.noarch.rpmLinux
Python39-wheel-wheel update (ELSA-2024-2985) python39-wheel-wheel-0.35.1-4.module+el8.9.0+90016+9c2d6573.noarch.rpmLinux
Python3.11-cryptography update (ELSA-2024-3105) python3.11-cryptography-37.0.2-6.el8.x86_64.rpmLinux
python-cryptography Security Update (ALAS-2023-446) python3-cryptography-36.0.1-1.amzn2023.0.5.x86_64.rpmLinux
python3.12 update (TU-CESAS-0023) python3.12-cryptography-41.0.7-2.el9.x86_64.rpmLinux
Moderate: python3.11-cryptography security update python3.11-cryptography-37.0.2-6.el9.x86_64.rpmLinux
Moderate: python3.11-cryptography security update python3.11-cryptography-37.0.2-6.el8.x86_64.rpmLinux
python3.11-cryptography security update (RLSA-2024:3105) python3.11-cryptography-37.0.2-6.el8.x86_64.rpmLinux
Python3.12-cryptography update (ELSA-2025-7317) python3.12-cryptography-41.0.7-2.el9.x86_64.rpmLinux
python-cryptography Security Update (ALAS2023-2023-446) python3-cryptography-36.0.1-1.amzn2023.0.5.x86_64.rpmLinux
Vulnerabilities CVE-2023-49083 are fixed in Python-cryptography for linux 41.0.6Linux
CVE-2023-49083NCM

Patch Details

Click to see the patches provided by ManageEngine for this CVE
Patch IDPatch Description
PATCH-336032Duo Security Authentication Proxy (6.3.0)
PATCH-338054Duo Security Authentication Proxy (6.4.0)
PATCH-338227Duo Security Authentication Proxy (6.4.1)
PATCH-342393Duo Security Authentication Proxy (6.4.2)
PATCH-342393Duo Security Authentication Proxy (6.4.2)
PATCH-347413Duo Security Authentication Proxy (6.5.0)

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234