cryptography@37.0.3 vulnerabilities

Affected versions of this package are vulnerable to Uncontrolled Resource Consumption due to improper user input validation in the EVP_PKEY_param_check or EVP_PKEY_public_check functions. An attacker can cause a denial of service by supplying excessively long DSA keys or parameters obtained from an untrusted source.

Note:

OpenSSL does not call these functions on untrusted DSA keys, so only applications that directly call these functions may be vulnerable.

Also vulnerable are the OpenSSL pkey and pkeyparam command line applications when using the "-check" option.

Upgrade cryptography to version 42.0.8 or higher.

Affected versions of this package are vulnerable to Uncontrolled Resource Consumption ('Resource Exhaustion') due to the session cache entering an incorrect state and failing to flush properly as it fills, leading to uncontrolled memory consumption. This condition is triggered under certain server configurations when processing TLSv1.3 sessions. Specifically, this occurs if the non-default SSL_OP_NO_TICKET option is enabled, but not if early_data support is configured along with the default anti-replay protection. A malicious client could deliberately create this scenario to force a service disruption. It may also occur accidentally in normal operation.

Note:

This issue is only exploitable if the server supports TLSv1.3 and is configured with the SSL_OP_NO_TICKET option enabled.

Upgrade cryptography to version 42.0.6 or higher.

Affected versions of this package are vulnerable to NULL Pointer Dereference when processing a maliciously formatted PKCS12 file. The vulnerability exists due to improper handling of optional ContentInfo fields, which can be set to null. An attacker can cause a denial of service by sending crafted input that leads to applications loading files in PKCS12 format from untrusted sources to terminate abruptly.

Upgrade cryptography to version 42.0.2 or higher.

Affected versions of this package are vulnerable to Resource Exhaustion via the EVP_PKEY_public_check function. When the function is called in RSA public keys, a computation is done to confirm that the RSA modulus, n, is composite. For valid RSA keys, n is a product of two or more large primes and this computation completes quickly. However, if n is a large prime, this computation takes a long time. An attacker can cause a denial of service by supplying a specially crafted RSA key that triggers extensive computation.

Upgrade cryptography to version 42.0.2 or higher.

Affected versions of this package are vulnerable to Observable Timing Discrepancy. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data (Marvin).

Note:

This vulnerability exists due to an incomplete fix for CVE-2020-25659.

Upgrade cryptography to version 42.0.0 or higher.

Affected versions of this package are vulnerable to NULL Pointer Dereference when loading PKCS7 certificates. An attacker can cause a Denial of Service (DoS) by attempting to deserialize a PKCS7 blob/certificate.

Note:

This is only exploitable if the load_pem_pkcs7_certificates or load_der_pkcs7_certificates functions are called.

Upgrade cryptography to version 41.0.6 or higher.

Affected versions of this package are vulnerable to Denial of Service (DoS) when the DH_generate_key(), DH_check_pub_key(), DH_check_pub_key_ex(), EVP_PKEY_public_check(), and EVP_PKEY_generate() functions are used. An attacker can cause long delays and potentially a Denial of Service by supplying excessively long X9.42 DH keys or parameters obtained from an untrusted source.

Note:

This is only exploitable if the application uses these functions to generate or check an X9.42 DH key or parameters. Also, the OpenSSL pkey command line application, when using the -pubcheck option, as well as the OpenSSL genpkey command line application, are vulnerable to this issue.

Upgrade cryptography to version 42.0.0 or higher.

Affected versions of this package are vulnerable to Missing Cryptographic Step when the EVP_EncryptInit_ex2(), EVP_DecryptInit_ex2() or EVP_CipherInit_ex2() functions are used. An attacker can cause truncation or overreading of key and initialization vector (IV) lengths by altering the "keylen" or "ivlen" parameters within the OSSL_PARAM array after the key and IV have been established. This can lead to potential truncation or overruns during the initialization of some symmetric ciphers, such as RC2, RC4, RC5, CCM, GCM, and OCB. A truncation in the IV can result in non-uniqueness, which could result in loss of confidentiality for some cipher modes.

Both truncations and overruns of the key and the IV will produce incorrect results and could, in some cases, trigger a memory exception.

Upgrade cryptography to version 41.0.5 or higher.

Affected versions of this package are vulnerable to Denial of Service (DoS). The POLY1305 MAC (message authentication code) implementation might corrupt the internal state of applications on the Windows 64 platform when running on newer X86_64 processors supporting AVX512-IFMA instructions. If an attacker can influence whether the POLY1305 MAC algorithm is used in an application, the application state might be corrupted with various application dependent consequences, the most likely of which being denial of service. The maintainers are currently not aware of any concrete application that would be affected by this issue.

NOTES:

This vulnerability is only exploitable on Windows.

The FIPS provider is not affected by this issue.

Upgrade cryptography to version 41.0.4 or higher.

Affected versions of this package are vulnerable to Denial of Service (DoS) when the DH_check(), DH_check_ex(), or EVP_PKEY_param_check() functions are used to check a DH key or DH parameters. An attacker can cause long delays and potentially a Denial of Service (DoS) by providing excessively long DH keys or parameters from an untrusted source. This is only exploitable if the application calls these functions and supplies a key or parameters obtained from an untrusted source.

Note: The OpenSSL SSL/TLS implementation and the OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.

Upgrade cryptography to version 41.0.3 or higher.

Affected versions of this package are vulnerable to Denial of Service (DoS) in the DH_check(), DH_check_ex() and EVP_PKEY_param_check() functions, which are used to check a DH key or DH parameters.

When the key or parameters that are being checked contain an excessively large modulus value (the p parameter) this may cause slowness in processing. Some checks use the supplied modulus value even if it has already been found to be too large.

The OpenSSL dhparam and pkeyparam command line applications are also vulnerable, when using the -check option.

NOTE: The OpenSSL SSL/TLS implementation is not affected by this issue.

Upgrade cryptography to version 41.0.3 or higher.

Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity in the AES-SIV cipher implementation in ciphers/cipher_aes_siv.c, which ignores empty associated data entries, making them unauthenticated.

Applications that use the AES-SIV algorithm and want to authenticate empty data entries as associated data can be misled by removing, adding or reordering such empty entries as these are ignored by the OpenSSL implementation.

NOTE: This issue does not affect non-empty associated data authentication and the maintainers are currently unaware of any applications that use empty associated data entries.

Upgrade cryptography to version 41.0.3 or higher.

Affected versions of this package are vulnerable to Improper Certificate Validation in the SSH certificate decoding process. An attacker can cause the application to accept unauthorized SSH certificates generated by ssh-keygen, or cause certificates generated by SSHCertificateBuilder to fail when read by ssh-keygen.

Note: This is only exploitable if the attacker controls the SSH certificate generation process or can introduce crafted SSH certificates into the system.

Upgrade cryptography to version 41.0.2 or higher.

Affected versions of this package are vulnerable to Denial of Service (DoS) when processing specially crafted ASN.1 objects identifiers. Applications that use OBJ_obj2txt() directly, or use any of the OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with no message size limit may experience notable to very long delays when processing those messages, which may lead to a exploitation of this vulnerability.

Upgrade cryptography to version 41.0.0 or higher.

Affected versions of this package are vulnerable to Denial of Service (DoS) due to a null pointer dereference in when signatures are being verified on PKCS7 signed or signedAndEnveloped data in pkcs7/pk7_doit.c. If the hash algorithm used for the signature is known to the OpenSSL library but the implementation of the hash algorithm is not available, the digest initialization will fail.

NOTE: The TLS implementation in OpenSSL does not call these functions.

Upgrade cryptography to version 39.0.1 or higher.

Affected versions of this package are vulnerable to Denial of Service (DoS) due to a null dereference when validating DSA public keys in the EVP_PKEY_public_check() function.

NOTE: The TLS implementation in OpenSSL does not call this function.

Upgrade cryptography to version 39.0.1 or higher.

Affected versions of this package are vulnerable to Use After Free in the BIO_new_NDEF() function. A new filter BIO can be freed, with the function returning a NULL result indicating a failure. But the BIO passed by the caller still holds pointers to the previously freed filter BIO. This could allow an attacker to cause a crash.

Upgrade cryptography to version 39.0.1 or higher.

Affected versions of this package are vulnerable to Access of Resource Using Incompatible Type ('Type Confusion') in x509/v3_genn.c, when processing X.400 addresses with CRL checking enabled (e.g. when X509_V_FLAG_CRL_CHECK is set). An attacker in possession of both the certificate chain and CRL, of which neither needs a valid signature, can expose memory or cause a denial of service. If the attacker only controls one of these inputs, the other input must already contain an X.400 address as a CRL distribution point, which is uncommon.

Upgrade cryptography to version 39.0.1 or higher.

Affected versions of this package are vulnerable to Timing Attack in rsa/rsa_ossl.c. An attacker can recover ciphertext with a Bleichenbacher style attack by sending a large number of trial messages (Marvin). This affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP, and RSASVE.

Upgrade cryptography to version 39.0.1 or higher.

Affected versions of this package are vulnerable to Denial of Service (DoS) due to an invalid pointer dereference in the d2i_PKCS7(), d2i_PKCS7_bio() and d2i_PKCS7_fp(). An attacker could trigger a crash by supplying malicious PKCS7 data.

NOTE: The TLS implementation in OpenSSL does not call these functions.

Upgrade cryptography to version 39.0.1 or higher.

Affected versions of this package are vulnerable to Denial of Service (DoS) due to a read buffer overflow in certificate name constraint checking in x509/v3_ncons.c. This occurs after certificate chain signature verification, and requires either a CA to have signed the malicious certificate or for the application to continue certificate verification despite failure to construct a path to a trusted issuer.

Upgrade cryptography to version 39.0.1 or higher.

Affected versions of this package are vulnerable to Denial of Service (DoS) due to a double free after calling the PEM_read_bio_ex() function. An attacker who supplies a malicious PEM file with a 0-length payload can trigger a crash.

Upgrade cryptography to version 39.0.1 or higher.

Affected versions of this package are vulnerable to Expected Behavior Violation in Cipher.update_into, which allows immutable objects (such as bytes) to be mutated, violating fundamental rules of Python. This allows programmers to misuse an API, and cannot be exploited by attacker-controlled data alone.

Upgrade cryptography to version 39.0.1 or higher.

Affected versions of this package are vulnerable to Denial of Service (DoS). If an X.509 certificate contains a malformed policy constraint and policy processing is enabled, then a write lock will be taken twice recursively. On some operating systems (most widely: Windows), this results in a denial of service when the affected process hangs.

NOTE: Policy processing being enabled on a publicly-facing server is not considered to be a common setup.

Upgrade cryptography to version 39.0.1 or higher.

Affected versions of this package are vulnerable to Buffer Overflow. A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to continue certificate verification despite failure to construct a path to a trusted issuer.

An attacker can craft a malicious email address to overflow an arbitrary number of bytes containing the . character (decimal 46) on the stack. This buffer overflow could result in a crash (causing a denial of service).

A full break down of this vulnerability can be found in our technical deep dive.

NOTE: The Node.js project has announced that 18.x and 19.x releases are affected, and fixed versions are expected on or soon after November 3. This advisory will be updated accordingly when they are released.

Changelog

November 1, 2022 - Advisory published.

November 2, 2022 - Node.js listed as affected, in advance of fix.

November 5, 2022 - Node.js fixed versions added.

Upgrade cryptography to version 38.0.3 or higher.