Uncontrolled Resource Consumption ('Resource Exhaustion') Affecting cryptography package, versions [35.0.0,42.0.6)
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-CRYPTOGRAPHY-6592767
- published 9 Apr 2024
- disclosed 8 Apr 2024
- credit Manish Patidar
Introduced: 8 Apr 2024
CVE-2024-2511 Open this link in a new tabHow to fix?
Upgrade cryptography to version 42.0.6 or higher.
Overview
Affected versions of this package are vulnerable to Uncontrolled Resource Consumption ('Resource Exhaustion') due to the session cache entering an incorrect state and failing to flush properly as it fills, leading to uncontrolled memory consumption. This condition is triggered under certain server configurations when processing TLSv1.3 sessions. Specifically, this occurs if the non-default SSL_OP_NO_TICKET option is enabled, but not if early_data support is configured along with the default anti-replay protection. A malicious client could deliberately create this scenario to force a service disruption. It may also occur accidentally in normal operation.
Note:
This issue is only exploitable if the server supports TLSv1.3 and is configured with the SSL_OP_NO_TICKET option enabled.