PkgSeer

Vulnerability GHSA-p423-j2cm-9vmq

Critical

6 months ago

Cryptography vulnerable to buffer overflow if non-contiguous buffers were passed to APIs

45.0.0 - 46.0.6

Summary

Cryptography vulnerable to buffer overflow if non-contiguous buffers were passed to APIs

Details

If a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. For example:

h = Hash(SHA256())
b.update(buf[::-1])

would read past the end of the buffer on Python >3.11

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees

0.1 - 48.0.1 PYSEC-2026-3554

cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing

44.0.0 - 49.0.0 PYSEC-2026-3552

python-cryptography: Duplicate self-signed intermediates can cause exponential path-building

0.1 - 48.0.1 PYSEC-2026-3553

python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees

45.0.0 - 48.0.1 GHSA-m2h6-j472-rp4c

python-cryptography: Duplicate self-signed intermediates can cause exponential path-building

42.0.0 - 48.0.1 GHSA-jwv3-5hgf-82ww

View all vulnerabilities for these packages

Impacted packages

cryptography

Timeline

Published

6 months ago

Fixed (46.0.7)

7 months ago

Last Modified

7 hours ago