Vulnerabilities
Misconfiguration
Compliance
CVE Vulnerabilities

CVE-2023-49083

NULL Pointer Dereference

Published: Nov 29, 2023 | Modified: Nov 03, 2025
CVSS 3.x
7.5
HIGH
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.x
RedHat/V2
RedHat/V3
7.5 MODERATE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Ubuntu
MEDIUM
Vulnerability-free packages from our partners
root.io logo minimus.io logo echo.ai logo
Additional information
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2023-49083
CWEhttps://cwe.mitre.org/data/definitions/476.html

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling load_pem_pkcs7_certificates or load_der_pkcs7_certificates could lead to a NULL-pointer dereference and segfault. Exploitation of this vulnerability poses a serious risk of Denial of Service (DoS) for any application attempting to deserialize a PKCS7 blob/certificate. The consequences extend to potential disruptions in system availability and stability. This vulnerability has been patched in version 41.0.6.

Weakness

The product dereferences a pointer that it expects to be valid but is NULL.

Affected Software

NameVendorStart VersionEnd Version
CryptographyCryptography.io3.1 (including)41.0.6 (excluding)
Red Hat Ansible Automation Platform 2.4 for RHEL 8RedHatautomation-controller-0:4.5.5-2.el8ap*
Red Hat Ansible Automation Platform 2.4 for RHEL 8RedHatpython3x-cryptography-0:42.0.5-1.el8ap*
Red Hat Ansible Automation Platform 2.4 for RHEL 9RedHatautomation-controller-0:4.5.5-2.el9ap*
Red Hat Ansible Automation Platform 2.4 for RHEL 9RedHatpython-cryptography-0:42.0.5-1.el9ap*
Red Hat Enterprise Linux 8RedHatpython3.11-cryptography-0:37.0.2-6.el8*
Red Hat Enterprise Linux 8RedHatpython-cryptography-0:3.2.1-8.el8_10*
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update SupportRedHatpython-cryptography-0:3.2.1-4.el8_4.1*
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-OnRedHatpython-cryptography-0:3.2.1-4.el8_4.1*
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update SupportRedHatpython-cryptography-0:3.2.1-5.1.el8_6.1*
Red Hat Enterprise Linux 8.6 Telecommunications Update ServiceRedHatpython-cryptography-0:3.2.1-5.1.el8_6.1*
Red Hat Enterprise Linux 8.6 Update Services for SAP SolutionsRedHatpython-cryptography-0:3.2.1-5.1.el8_6.1*
Red Hat Enterprise Linux 8.8 Extended Update SupportRedHatpython3.11-cryptography-0:37.0.2-5.el8_8.1*
Red Hat Enterprise Linux 8.8 Telecommunications Update ServiceRedHatpython-cryptography-0:3.2.1-6.el8_8*
Red Hat Enterprise Linux 8.8 Update Services for SAP SolutionsRedHatpython-cryptography-0:3.2.1-6.el8_8*
Red Hat Enterprise Linux 9RedHatpython3.11-cryptography-0:37.0.2-6.el9*
Red Hat Enterprise Linux 9RedHatpython-cryptography-0:36.0.1-5.el9_6*
Red Hat Enterprise Linux 9.0 Update Services for SAP SolutionsRedHatpython-cryptography-0:36.0.1-1.el9_0.1*
Red Hat Enterprise Linux 9.2 Update Services for SAP SolutionsRedHatpython-cryptography-0:36.0.1-2.el9_2.1*
Red Hat Enterprise Linux 9.4 Extended Update SupportRedHatpython-cryptography-0:36.0.1-4.el9_4.1*
RHUI 4 for RHEL 8RedHatpython-cryptography-0:41.0.6-1.el8ui*
Python-cryptographyUbuntubionic*
Python-cryptographyUbuntudevel*
Python-cryptographyUbuntujammy*
Python-cryptographyUbuntulunar*
Python-cryptographyUbuntumantic*
Python-cryptographyUbuntutrusty*
Python-cryptographyUbuntuxenial*

Potential Mitigations

References

Aqua Security is the largest pure-play cloud native security company, providing customers the freedom to innovate and run their businesses with minimal friction. The Aqua Cloud Native Security Platform provides prevention, detection, and response automation across the entire application lifecycle to secure the build, secure cloud infrastructure and secure running workloads wherever they are deployed.
Copyright © 2026 Aqua Security Software Ltd.   Privacy Policy | Terms of Use