NULL pointer deference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override

Moderate

alex published GHSA-6vqw-3v5j-54x4

Feb 21, 2024

Package

cryptography (pip)

Affected versions

>=38.0.0

Patched versions

>=42.0.4

Description

If pkcs12.serialize_key_and_certificates is called with both:

A certificate whose public key did not match the provided private key
An encryption_algorithm with hmac_hash set (via PrivateFormat.PKCS12.encryption_builder().hmac_hash(...)

Then a NULL pointer dereference would occur, crashing the Python process.

This has been resolved, and now a ValueError is properly raised.

Patched in #10423