Skip to content
fr Sign in
7.5 High

CVE-2024-26130 cryptography is a package designed to expose cryptographic primitives and recipes to Python developers

Description

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Starting in version 38.0.0 and prior to version 42.0.4, if `pkcs12.serialize_key_and_certificates` is called with both a certificate whose public key did not match the provided private key and an `encryption_algorithm` with `hmac_hash` set (via `PrivateFormat.PKCS12.encryption_builder().hmac_hash(...)`, then a NULL pointer dereference would occur, crashing the Python process. This has been resolved in version 42.0.4, the first version in which a `ValueError` is properly raised.

Affected products and versions

Product Affected versions Fixed in
cryptography 38.0 38.0.0 → < 42.0.4 42.0.4
cryptography 38.0 38.0.0 → < 42.04 42.04

References

Timeline

  1. Published
  2. Last modified

Other CVEs of cryptography

The 9 CVEs of cryptography →
CVE-2026-69249 python-cryptography is a package designed to expose cryptographic primitives and recipes to Python developers 8.7 High CVE-2026-69248 cryptography is a package designed to expose cryptographic primitives and recipes to Python developers 6.9 Medium CVE-2026-69247 cryptography is a package designed to expose cryptographic primitives and recipes to Python developers 8.2 High CVE-2026-39892 cryptography has a buffer overflow if non-contiguous buffers were passed to APIs 6.9 Medium
Track this CVE