Homepage
About Snyk

cryptography@42.0.3 vulnerabilities

cryptography is a package which provides cryptographic recipes and primitives to Python developers.

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the cryptography package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • L
Uncontrolled Resource Consumption ('Resource Exhaustion')

Affected versions of this package are vulnerable to Uncontrolled Resource Consumption ('Resource Exhaustion') due to the session cache entering an incorrect state and failing to flush properly as it fills, leading to uncontrolled memory consumption. This condition is triggered under certain server configurations when processing TLSv1.3 sessions. Specifically, this occurs if the non-default SSL_OP_NO_TICKET option is enabled, but not if early_data support is configured along with the default anti-replay protection. A malicious client could deliberately create this scenario to force a service disruption. It may also occur accidentally in normal operation.

Note:

This issue is only exploitable if the server supports TLSv1.3 and is configured with the SSL_OP_NO_TICKET option enabled.

How to fix Uncontrolled Resource Consumption ('Resource Exhaustion')?

Upgrade cryptography to version 42.0.6 or higher.

[35.0.0,42.0.6)
  • M
NULL Pointer Dereference

Affected versions of this package are vulnerable to NULL Pointer Dereference in the pkcs12.serialize_key_and_certificates function. An attacker can crash the Python process.

Note: This is only exploitable if the vulnerable function is called with both:

  1. A certificate whose public key does not match the provided private key.

  2. An encryption_algorithm with hmac_hash set via PrivateFormat.PKCS12.encryption_builder().hmac_hash(...).

How to fix NULL Pointer Dereference?

Upgrade cryptography to version 42.0.4 or higher.

[38.0.0,42.0.4)
Go back to all versions of this package