x/vulndb: potential Go vuln in github.com/pyca/cryptography: CVE-2023-49083

[GoVulnBot]

CVE-2023-49083 references github.com/pyca/cryptography, which may be a Go module.

Description:
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling load_pem_pkcs7_certificates or load_der_pkcs7_certificates could lead to a NULL-pointer dereference and segfault. Exploitation of this vulnerability poses a serious risk of Denial of Service (DoS) for any application attempting to deserialize a PKCS7 blob/certificate. The consequences extend to potential disruptions in system availability and stability. This vulnerability has been patched in version 41.0.6.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2023-49083
• JSON: https://github.com/CVEProject/cvelist/tree/2806b5b39e538168df8b943675064fc9c71e8aa1/2023/49xxx/CVE-2023-49083.json
• advisory: GHSA-jfhm-5ghh-2f97
• fix: Fixed crash when loading a PKCS#7 bundle with no certificates pyca/cryptography#9926
• fix: pyca/cryptography@f09c261
• Imported by: https://pkg.go.dev/github.com/pyca/cryptography?tab=importedby

Cross references:

• Module github.com/pyca/cryptography appears in issue x/vulndb: potential Go vuln in github.com/pyca/cryptography: CVE-2020-25659 #430 NOT_GO_CODE
• Module github.com/pyca/cryptography appears in issue x/vulndb: potential Go vuln in github.com/pyca/cryptography: CVE-2020-36242 #431 NOT_GO_CODE
• Module github.com/pyca/cryptography appears in issue x/vulndb: potential Go vuln in github.com/pyca/cryptography: CVE-2023-23931 #1536 NOT_GO_CODE
• Module github.com/pyca/cryptography appears in issue x/vulndb: potential Go vuln in github.com/pyca/cryptography: CVE-2023-38325 #1920 NOT_GO_CODE

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/pyca/cryptography
      vulnerable_at: 0.0.0-20231129023145-11e92173875d
      packages:
        - package: cryptography
cves:
    - CVE-2023-49083
references:
    - advisory: https://github.com/pyca/cryptography/security/advisories/GHSA-jfhm-5ghh-2f97
    - fix: https://github.com/pyca/cryptography/pull/9926
    - fix: https://github.com/pyca/cryptography/commit/f09c261ca10a31fe41b1262306db7f8f1da0e48a

[gopherbot]

Change https://go.dev/cl/545818 mentions this issue: data/excluded: batch add 13 excluded reports