CVE-2023-49083

A null-pointer dereference vulnerability was found in python-cryptography during the loading of PKCS7 certificates. Invoking "load_pem_pkcs7_certificates" or "load_der_pkcs7_certificates" can trigger this issue and lead to subsequent segmentation fault and result in a Denial of Service (DoS) for any application aiming to deserialize a PKCS7 blob or certificate. The potential impact includes disruptions in system availability and stability.

This vulnerability arises when functions like "load_pem_pkcs7_certificates" or "load_der_pkcs7_certificates" are invoked, triggering the issue during the deserialization of PKCS7 blobs or certificates. The moderate rating is based on the fact that the vulnerability can lead to a segmentation fault, posing a risk of disrupting the normal functioning of any application attempting to deserialize the mentioned certificates. While the impact is significant in terms of service denial and potential system instability, the severity is deemed moderate as it does not directly expose sensitive data or allow for remote code execution, focusing primarily on the localized consequences of a DoS scenario.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.