CVE-2024-26130 cryptography NULL pointer dereference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override
A NULL pointer dereference in the Python cryptography library causes a crash when serializing mismatched keys with specific HMAC settings.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-26130?
CVE-2024-26130 is a high-severity vulnerability in pyca cryptography, published on 21 Feb 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Starting in version 38.0.0 and prior to version 42.0.4, if `pkcs12.serialize_key_and_certificates` is called with both a certificate whose public key did not match the provided private key and an `encryption_algorithm` with `hmac_hash` set (via `PrivateFormat.PKCS12.encryption_builder().hmac_hash(...)`, then a NULL pointer dereference would occur, crashing the Python process. This has been resolved in version 42.0.4, the first version in which a `ValueError` is properly raised.
Weakness: CWE-476
Which versions are affected by CVE-2024-26130?
3 open source packages ship an affected version, including cryptography. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
cryptography PyPI | From 38.0.0 | 42.0.4 |
cryptography PyPI | From 38.0.0 | 42.0.4 |
cryptography PyPI | From 38.0.0 | 42.0.4 |
Linux distribution packages (10)
python3.12-cryptography AlmaLinux:9 | All versions | 41.0.7-2.el9_6.1 |
python3.12-cryptography Red Hat:enterprise_linux:9::appstream | All versions | 0:41.0.7-2.el9_6.1 |
python3.12-cryptography-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:41.0.7-2.el9_6.1 |
python3.12-cryptography-debugsource Red Hat:enterprise_linux:9::appstream | All versions | 0:41.0.7-2.el9_6.1 |
python3.12-cryptography Rocky Linux:9 | All versions | 0:41.0.7-2.el9_6.1 |
python-cryptography SUSE:Linux Enterprise Module for Python 3 15 SP5 | All versions | 41.0.3-150400.16.15.1 |
python-cryptography SUSE:Linux Enterprise Module for Python 3 15 SP6 | All versions | 41.0.3-150600.23.3.1 |
python-cryptography openSUSE:Leap 15.5 | All versions | 41.0.3-150400.16.15.1 |
python-cryptography openSUSE:Leap 15.6 | All versions | 41.0.3-150600.23.3.1 |
python-cryptography openSUSE:Tumbleweed | All versions | 42.0.4-1.1 |
Products include Cryptography.io Cryptography.
How do I fix CVE-2024-26130?
Upgrade cryptography to 42.0.4 or later.
Is CVE-2024-26130 being exploited?
There is no known exploitation of CVE-2024-26130 in the wild and no public exploit code.
Other vulnerabilities in pyca cryptography
- CVE-2020-36242 PyCA Cryptography symmetrically encrypting large values can lead to integer overflow
- CVE-2026-26007 cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves
- CVE-2023-38325 cryptography mishandles SSH certificates
- CVE-2026-39892 cryptography has a buffer overflow if non-contiguous buffers were passed to APIs
- CVE-2023-49083 cryptography vulnerable to NULL-dereference when loading PKCS7 certificates
Sources
Also known as ALSA-2025:15608, BELL-CVE-2024-26130, DEBIAN-CVE-2024-26130, ECHO-c0e9-a477-5a84, GHSA-6vqw-3v5j-54x4, PYSEC-2024-225 and 8 more.