CVE-2024-26130
Fixed in a distro release EPSS <1%CVSS 7.5
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Starting in version 38.0.0 and prior to version 42.0.4, if `pkcs12.serialize_key_and_certificates` is called with both a certificate whose public key did not match the provided private key and an `encryption_algorithm` with `hmac_hash` set (via `PrivateFormat.PKCS12.encryption_builder().hmac_hash(...)`, then a NULL pointer dereference would occur, crashing the Python process. This has been resolved in version 42.0.4, the first version in which a `ValueError` is properly raised.
Products: pyca cryptography, cryptography_project cryptography
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | cryptography | 42.0.4 |
| PyPI | cryptography | 97d231672763cdb5959a3b191e692a362f1b9e55 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 9 | python3.12-cryptography | 41.0.7-2.el9_6.1 |
| Chainguard | airflow | no fix |
| Chainguard | airflow | 2.10.5-r44 |
| Chainguard | airflow-bitnami-compat | no fix |
| Chainguard | az | 2.58.0-r0 |
| Chainguard | az-iamguarded-compat | 2.58.0-r0 |
| Chainguard | ggshield | 1.25.0-r0 |
| Chainguard | kubeflow-pipelines | 2.0.5-r3 |
| Chainguard | kubeflow-pipelines-apiserver | 2.0.5-r3 |
| Chainguard | kubeflow-pipelines-cache-deployer | 2.0.5-r3 |
| Chainguard | kubeflow-pipelines-cache-deployer-compat | 2.0.5-r3 |
| Chainguard | kubeflow-pipelines-cache_server | 2.0.5-r3 |
| Chainguard | kubeflow-pipelines-frontend | 2.0.5-r3 |
| Chainguard | kubeflow-pipelines-metadata-envoy-config | 2.0.5-r3 |
| Chainguard | kubeflow-pipelines-metadata-writer | 2.0.5-r3 |
| Chainguard | kubeflow-pipelines-metadata-writer-compat | 2.0.5-r3 |
| Chainguard | kubeflow-pipelines-persistence_agent | 2.0.5-r3 |
| Chainguard | kubeflow-pipelines-scheduledworkflow | 2.0.5-r3 |
| Chainguard | kubeflow-pipelines-viewer-crd-controller | 2.0.5-r3 |
| Chainguard | mitmproxy | 12.2.1-r0 |
| Chainguard | py3-cassandra-medusa | 0.19.1-r1 |
| Chainguard | py3-cassandra-medusa-compat | 0.19.1-r1 |
| Chainguard | py3-cryptography | 42.0.4-r0 |
| Chainguard | py3.10-cryptography | 42.0.4-r0 |
| Chainguard | py3.11-cryptography | 42.0.4-r0 |
| Chainguard | py3.12-cryptography | 42.0.4-r0 |
| Chainguard | request-1276 | 0.23.0-r30 |
| Chainguard | request-1276-compat | 0.23.0-r30 |
| Debian 12 | python-cryptography | 38.0.4-3+deb12u1 |
| Debian 13 | python-cryptography | 42.0.5-1 |
| Debian 14 | python-cryptography | 42.0.5-1 |
| Red Hat ansible automation platform 2.4 | automation-controller-venv-tower | 0:4.5.7-1.el9ap |
| Red Hat ansible automation platform 2.4 | automation-controller-venv-tower | 0:4.5.7-1.el8ap |
| Red Hat ansible automation platform 2.4 | automation-hub | 0:4.9.2-1.el8ap |
| Red Hat ansible automation platform 2.4 | automation-hub | 0:4.9.2-1.el9ap |
| Red Hat ansible automation platform 2.4 | python-aiohttp | 0:3.9.5-1.el9ap |
| Red Hat ansible automation platform 2.4 | python-aiohttp-debugsource | 0:3.9.5-1.el9ap |
| Red Hat ansible automation platform 2.4 | python-black | 0:22.8.0-2.el9ap |
| Red Hat ansible automation platform 2.4 | python-cryptography | 0:42.0.5-1.el9ap |
| Red Hat ansible automation platform 2.4 | python-cryptography-debugsource | 0:42.0.5-1.el9ap |
| Red Hat ansible automation platform 2.4 | python-galaxy-ng | 0:4.9.2-1.el9ap |
| Red Hat ansible automation platform 2.4 | python-gunicorn | 0:22.0.0-1.el9ap |
| Red Hat ansible automation platform 2.4 | python-idna | 0:3.7-1.el9ap |
| Red Hat ansible automation platform 2.4 | python-jinja2 | 0:3.1.4-1.el9ap |
| Red Hat ansible automation platform 2.4 | python-pillow | 0:10.3.0-1.el9ap |
| Red Hat ansible automation platform 2.4 | python-pillow-debugsource | 0:10.3.0-1.el9ap |
| Red Hat ansible automation platform 2.4 | python-pydantic | 0:1.10.15-1.el9ap |
| Red Hat ansible automation platform 2.4 | python-requests | 0:2.32.2-1.el9ap |
| Red Hat ansible automation platform 2.4 | python-social-auth-app-django | 0:5.4.1-1.el9ap |
| Red Hat ansible automation platform 2.4 | python-sqlparse | 0:0.5.0-1.el9ap |
| Red Hat ansible automation platform 2.4 | python3-aiohttp | 0:3.9.5-1.el9ap |
| Red Hat ansible automation platform 2.4 | python3-aiohttp-debuginfo | 0:3.9.5-1.el9ap |
| Red Hat ansible automation platform 2.4 | python3-black | 0:22.8.0-2.el9ap |
| Red Hat ansible automation platform 2.4 | python3-cryptography | 0:42.0.5-1.el9ap |
| Red Hat ansible automation platform 2.4 | python3-cryptography-debuginfo | 0:42.0.5-1.el9ap |
| Red Hat ansible automation platform 2.4 | python3-galaxy-ng | 0:4.9.2-1.el9ap |
| Red Hat ansible automation platform 2.4 | python3-gunicorn | 0:22.0.0-1.el9ap |
| Red Hat ansible automation platform 2.4 | python3-idna | 0:3.7-1.el9ap |
| Red Hat ansible automation platform 2.4 | python3-jinja2 | 0:3.1.4-1.el9ap |
| Red Hat ansible automation platform 2.4 | python3-pillow | 0:10.3.0-1.el9ap |
| Red Hat ansible automation platform 2.4 | python3-pillow-debuginfo | 0:10.3.0-1.el9ap |
| Red Hat ansible automation platform 2.4 | python3-pydantic | 0:1.10.15-1.el9ap |
| Red Hat ansible automation platform 2.4 | python3-requests | 0:2.32.2-1.el9ap |
| Red Hat ansible automation platform 2.4 | python3-social-auth-app-django | 0:5.4.1-1.el9ap |
| Red Hat ansible automation platform 2.4 | python3-sqlparse | 0:0.5.0-1.el9ap |
| Red Hat ansible automation platform 2.4 | python39-aiohttp | 0:3.9.5-1.el8ap |
| Red Hat ansible automation platform 2.4 | python39-aiohttp-debuginfo | 0:3.9.5-1.el8ap |
| Red Hat ansible automation platform 2.4 | python39-black | 0:22.8.0-2.el8ap |
| Red Hat ansible automation platform 2.4 | python39-cryptography | 0:42.0.5-1.el8ap |
| Red Hat ansible automation platform 2.4 | python39-cryptography-debuginfo | 0:42.0.5-1.el8ap |
| Red Hat ansible automation platform 2.4 | python39-galaxy-ng | 0:4.9.2-1.el8ap |
| Red Hat ansible automation platform 2.4 | python39-gunicorn | 0:22.0.0-1.el8ap |
| Red Hat ansible automation platform 2.4 | python39-idna | 0:3.7-1.el8ap |
| Red Hat ansible automation platform 2.4 | python39-jinja2 | 0:3.1.4-1.el8ap |
| Red Hat ansible automation platform 2.4 | python39-pillow | 0:10.3.0-1.el8ap |
| Red Hat ansible automation platform 2.4 | python39-pillow-debuginfo | 0:10.3.0-1.el8ap |
| Red Hat ansible automation platform 2.4 | python39-pydantic | 0:1.10.15-1.el8ap |
| Red Hat ansible automation platform 2.4 | python39-requests | 0:2.32.2-1.el8ap |
| Red Hat ansible automation platform 2.4 | python39-social-auth-app-django | 0:5.4.1-1.el8ap |
| Red Hat ansible automation platform 2.4 | python39-sqlparse | 0:0.5.0-1.el8ap |
| Red Hat ansible automation platform 2.4 | python3x-aiohttp | 0:3.9.5-1.el8ap |
| Red Hat ansible automation platform 2.4 | python3x-aiohttp-debugsource | 0:3.9.5-1.el8ap |
| Red Hat ansible automation platform 2.4 | python3x-black | 0:22.8.0-2.el8ap |
| Red Hat ansible automation platform 2.4 | python3x-cryptography | 0:42.0.5-1.el8ap |
| Red Hat ansible automation platform 2.4 | python3x-cryptography-debugsource | 0:42.0.5-1.el8ap |
| Red Hat ansible automation platform 2.4 | python3x-galaxy-ng | 0:4.9.2-1.el8ap |
| Red Hat ansible automation platform 2.4 | python3x-gunicorn | 0:22.0.0-1.el8ap |
| Red Hat ansible automation platform 2.4 | python3x-idna | 0:3.7-1.el8ap |
| Red Hat ansible automation platform 2.4 | python3x-jinja2 | 0:3.1.4-1.el8ap |
| Red Hat ansible automation platform 2.4 | python3x-pillow | 0:10.3.0-1.el8ap |
| Red Hat ansible automation platform 2.4 | python3x-pillow-debugsource | 0:10.3.0-1.el8ap |
| Red Hat ansible automation platform 2.4 | python3x-pydantic | 0:1.10.15-1.el8ap |
| Red Hat ansible automation platform 2.4 | python3x-requests | 0:2.32.2-1.el8ap |
| Red Hat ansible automation platform 2.4 | python3x-social-auth-app-django | 0:5.4.1-1.el8ap |
| Red Hat ansible automation platform 2.4 | python3x-sqlparse | 0:0.5.0-1.el8ap |
| Red Hat ansible automation platform 2.4 | receptor | 0:1.4.8-1.el8ap |
| Red Hat ansible automation platform 2.4 | receptor | 0:1.4.8-1.el9ap |
| Red Hat ansible automation platform 2.4 | receptorctl | 0:1.4.8-1.el9ap |
| Red Hat ansible automation platform 2.4 | receptorctl | 0:1.4.8-1.el8ap |
| Red Hat ansible automation platform developer 2.4 | python-black | 0:22.8.0-2.el9ap |
| Red Hat ansible automation platform developer 2.4 | python-cryptography | 0:42.0.5-1.el9ap |
| Red Hat ansible automation platform developer 2.4 | python-cryptography-debugsource | 0:42.0.5-1.el9ap |
| Red Hat ansible automation platform developer 2.4 | python-idna | 0:3.7-1.el9ap |
| Red Hat ansible automation platform developer 2.4 | python-jinja2 | 0:3.1.4-1.el9ap |
| Red Hat ansible automation platform developer 2.4 | python-requests | 0:2.32.2-1.el9ap |
| Red Hat ansible automation platform developer 2.4 | python3-black | 0:22.8.0-2.el9ap |
| Red Hat ansible automation platform developer 2.4 | python3-cryptography | 0:42.0.5-1.el9ap |
| Red Hat ansible automation platform developer 2.4 | python3-cryptography-debuginfo | 0:42.0.5-1.el9ap |
| Red Hat ansible automation platform developer 2.4 | python3-idna | 0:3.7-1.el9ap |
| Red Hat ansible automation platform developer 2.4 | python3-jinja2 | 0:3.1.4-1.el9ap |
| Red Hat ansible automation platform developer 2.4 | python3-requests | 0:2.32.2-1.el9ap |
| Red Hat ansible automation platform developer 2.4 | python39-black | 0:22.8.0-2.el8ap |
| Red Hat ansible automation platform developer 2.4 | python39-cryptography | 0:42.0.5-1.el8ap |
| Red Hat ansible automation platform developer 2.4 | python39-cryptography-debuginfo | 0:42.0.5-1.el8ap |
| Red Hat ansible automation platform developer 2.4 | python39-idna | 0:3.7-1.el8ap |
| Red Hat ansible automation platform developer 2.4 | python39-jinja2 | 0:3.1.4-1.el8ap |
| Red Hat ansible automation platform developer 2.4 | python39-requests | 0:2.32.2-1.el8ap |
| Red Hat ansible automation platform developer 2.4 | python3x-black | 0:22.8.0-2.el8ap |
| Red Hat ansible automation platform developer 2.4 | python3x-cryptography | 0:42.0.5-1.el8ap |
| Red Hat ansible automation platform developer 2.4 | python3x-cryptography-debugsource | 0:42.0.5-1.el8ap |
| Red Hat ansible automation platform developer 2.4 | python3x-idna | 0:3.7-1.el8ap |
| Red Hat ansible automation platform developer 2.4 | python3x-jinja2 | 0:3.1.4-1.el8ap |
| Red Hat ansible automation platform developer 2.4 | python3x-requests | 0:2.32.2-1.el8ap |
| Red Hat ansible automation platform developer 2.4 | receptor | 0:1.4.8-1.el8ap |
| Red Hat ansible automation platform developer 2.4 | receptor | 0:1.4.8-1.el9ap |
| Red Hat ansible automation platform developer 2.4 | receptorctl | 0:1.4.8-1.el8ap |
| Red Hat ansible automation platform developer 2.4 | receptorctl | 0:1.4.8-1.el9ap |
| Red Hat ansible automation platform inside 2.4 | python-black | 0:22.8.0-2.el9ap |
| Red Hat ansible automation platform inside 2.4 | python-cryptography | 0:42.0.5-1.el9ap |
| Red Hat ansible automation platform inside 2.4 | python-cryptography-debugsource | 0:42.0.5-1.el9ap |
| Red Hat ansible automation platform inside 2.4 | python-jinja2 | 0:3.1.4-1.el9ap |
| Red Hat ansible automation platform inside 2.4 | python3-black | 0:22.8.0-2.el9ap |
| Red Hat ansible automation platform inside 2.4 | python3-cryptography | 0:42.0.5-1.el9ap |
| Red Hat ansible automation platform inside 2.4 | python3-cryptography-debuginfo | 0:42.0.5-1.el9ap |
| Red Hat ansible automation platform inside 2.4 | python3-jinja2 | 0:3.1.4-1.el9ap |
| Red Hat ansible automation platform inside 2.4 | python39-black | 0:22.8.0-2.el8ap |
| Red Hat ansible automation platform inside 2.4 | python39-cryptography | 0:42.0.5-1.el8ap |
| Red Hat ansible automation platform inside 2.4 | python39-cryptography-debuginfo | 0:42.0.5-1.el8ap |
| Red Hat ansible automation platform inside 2.4 | python39-jinja2 | 0:3.1.4-1.el8ap |
| Red Hat ansible automation platform inside 2.4 | python3x-black | 0:22.8.0-2.el8ap |
| Red Hat ansible automation platform inside 2.4 | python3x-cryptography | 0:42.0.5-1.el8ap |
| Red Hat ansible automation platform inside 2.4 | python3x-cryptography-debugsource | 0:42.0.5-1.el8ap |
| Red Hat ansible automation platform inside 2.4 | python3x-jinja2 | 0:3.1.4-1.el8ap |
| Red Hat ansible automation platform inside 2.4 | receptor | 0:1.4.8-1.el9ap |
| Red Hat ansible automation platform inside 2.4 | receptor | 0:1.4.8-1.el8ap |
| Red Hat ansible automation platform inside 2.4 | receptorctl | 0:1.4.8-1.el9ap |
| Red Hat ansible automation platform inside 2.4 | receptorctl | 0:1.4.8-1.el8ap |
| Red Hat Enterprise Linux 9 | python3.12-cryptography | 0:41.0.7-2.el9_6.1 |
| Red Hat Enterprise Linux 9 | python3.12-cryptography-debuginfo | 0:41.0.7-2.el9_6.1 |
| Red Hat Enterprise Linux 9 | python3.12-cryptography-debugsource | 0:41.0.7-2.el9_6.1 |
| Red Hat rhui 4 | python-aiohttp | 0:3.9.4-1.el8ui |
| Red Hat rhui 4 | python-aiohttp-debugsource | 0:3.9.4-1.el8ui |
| Red Hat rhui 4 | python-cryptography | 0:42.0.8-1.el8ui |
| Red Hat rhui 4 | python-cryptography-debugsource | 0:42.0.8-1.el8ui |
| Red Hat rhui 4 | python-django | 0:4.2.15-1.el8ui |
| Red Hat rhui 4 | python-grpcio | 0:1.65.4-1.el8ui |
| Red Hat rhui 4 | python-grpcio-debugsource | 0:1.65.4-1.el8ui |
| Red Hat rhui 4 | python-gunicorn | 0:22.0.0-1.0.1.el8ui |
| Red Hat rhui 4 | python-jinja2 | 0:3.1.4-1.el8ui |
| Red Hat rhui 4 | python-requests | 0:2.32.3-2.el8ui |
| Red Hat rhui 4 | python-sqlparse | 0:0.5.0-1.el8ui |
| Red Hat rhui 4 | python3.11-aiohttp | 0:3.9.4-1.el8ui |
| Red Hat rhui 4 | python3.11-aiohttp-debuginfo | 0:3.9.4-1.el8ui |
| Red Hat rhui 4 | python3.11-cryptography | 0:42.0.8-1.el8ui |
| Red Hat rhui 4 | python3.11-cryptography-debuginfo | 0:42.0.8-1.el8ui |
| Red Hat rhui 4 | python3.11-django | 0:4.2.15-1.el8ui |
| Red Hat rhui 4 | python3.11-grpcio | 0:1.65.4-1.el8ui |
| Red Hat rhui 4 | python3.11-grpcio-debuginfo | 0:1.65.4-1.el8ui |
| Red Hat rhui 4 | python3.11-gunicorn | 0:22.0.0-1.0.1.el8ui |
| Red Hat rhui 4 | python3.11-jinja2 | 0:3.1.4-1.el8ui |
| Red Hat rhui 4 | python3.11-requests | 0:2.32.3-2.el8ui |
| Red Hat rhui 4 | python3.11-sqlparse | 0:0.5.0-1.el8ui |
| Red Hat satellite 6.15 | python-cryptography | 0:42.0.8-1.el8pc |
| Red Hat satellite 6.15 | python-cryptography-debugsource | 0:42.0.8-1.el8pc |
| Red Hat satellite 6.15 | python-django | 0:4.2.15-1.el8pc |
| Red Hat satellite 6.15 | python-gunicorn | 0:22.0.0-1.el8pc |
| Red Hat satellite 6.15 | python3.11-cryptography | 0:42.0.8-1.el8pc |
| Red Hat satellite 6.15 | python3.11-cryptography-debuginfo | 0:42.0.8-1.el8pc |
| Red Hat satellite 6.15 | python3.11-django | 0:4.2.15-1.el8pc |
| Red Hat satellite 6.15 | python3.11-gunicorn | 0:22.0.0-1.el8pc |
| Red Hat satellite 6.15 | rubygem-foreman_theme_satellite | 0:13.3.0-0.1.el8sat |
| Red Hat satellite 6.15 | yggdrasil-worker-forwarder | 0:0.0.3-2.el8sat |
| Red Hat satellite capsule 6.15 | python-cryptography | 0:42.0.8-1.el8pc |
| Red Hat satellite capsule 6.15 | python-cryptography-debugsource | 0:42.0.8-1.el8pc |
| Red Hat satellite capsule 6.15 | python-django | 0:4.2.15-1.el8pc |
| Red Hat satellite capsule 6.15 | python-gunicorn | 0:22.0.0-1.el8pc |
| Red Hat satellite capsule 6.15 | python3.11-cryptography | 0:42.0.8-1.el8pc |
| Red Hat satellite capsule 6.15 | python3.11-cryptography-debuginfo | 0:42.0.8-1.el8pc |
| Red Hat satellite capsule 6.15 | python3.11-django | 0:4.2.15-1.el8pc |
| Red Hat satellite capsule 6.15 | python3.11-gunicorn | 0:22.0.0-1.el8pc |
| Rocky Linux 9 | python3.12-cryptography | 0:41.0.7-2.el9_6.1 |
| SUSE Linux Enterprise Module for Python 3 15 SP5 | python-cryptography | 41.0.3-150400.16.15.1 |
| SUSE Linux Enterprise Module for Python 3 15 SP6 | python-cryptography | 41.0.3-150600.23.3.1 |
| Ubuntu 20.04 LTS | python-cryptography | 2.8-3ubuntu0.3 |
| Ubuntu 22.04 LTS | python-cryptography | 3.4.8-1ubuntu2.2 |
| Ubuntu 24.04 LTS | python-cryptography | 41.0.7-4ubuntu0.1 |
| Ubuntu Pro 18.04 LTS | python-cryptography | 2.1.4-1ubuntu1.4+esm1 |
| Wolfi | airflow | no fix |
| Wolfi | airflow | 2.10.5-r44 |
| Wolfi | airflow-bitnami-compat | no fix |
| Wolfi | az | 2.58.0-r0 |
| Wolfi | az-iamguarded-compat | 2.58.0-r0 |
| Wolfi | ggshield | 1.25.0-r0 |
| Wolfi | kubeflow-pipelines | 2.0.5-r3 |
| Wolfi | kubeflow-pipelines-apiserver | 2.0.5-r3 |
| Wolfi | kubeflow-pipelines-cache-deployer | 2.0.5-r3 |
| Wolfi | kubeflow-pipelines-cache-deployer-compat | 2.0.5-r3 |
| Wolfi | kubeflow-pipelines-cache_server | 2.0.5-r3 |
| Wolfi | kubeflow-pipelines-frontend | 2.0.5-r3 |
| Wolfi | kubeflow-pipelines-metadata-envoy-config | 2.0.5-r3 |
| Wolfi | kubeflow-pipelines-metadata-writer | 2.0.5-r3 |
| Wolfi | kubeflow-pipelines-metadata-writer-compat | 2.0.5-r3 |
| Wolfi | kubeflow-pipelines-persistence_agent | 2.0.5-r3 |
| Wolfi | kubeflow-pipelines-scheduledworkflow | 2.0.5-r3 |
| Wolfi | kubeflow-pipelines-viewer-crd-controller | 2.0.5-r3 |
| Wolfi | mitmproxy | 12.2.1-r0 |
| Wolfi | py3-cassandra-medusa | 0.19.1-r1 |
| Wolfi | py3-cassandra-medusa-compat | 0.19.1-r1 |
| Wolfi | py3-cryptography | 42.0.4-r0 |
| Wolfi | py3.10-cryptography | 42.0.4-r0 |
| Wolfi | py3.11-cryptography | 42.0.4-r0 |
| Wolfi | py3.12-cryptography | 42.0.4-r0 |
| openSUSE Leap 15.5 | python-cryptography | 41.0.3-150400.16.15.1 |
| openSUSE Leap 15.6 | python-cryptography | 41.0.3-150600.23.3.1 |
| openSUSE Tumbleweed | python-cryptography | 42.0.4-1.1 |
| openSUSE Tumbleweed | python-cryptography | 50.0.0-1.1 |