Search for vulnerabilities
Vulnerability details: VCID-92vn-rkhm-s3aw
Vulnerability ID VCID-92vn-rkhm-s3aw
Aliases CVE-2023-49083
GHSA-jfhm-5ghh-2f97
PYSEC-2023-254
Summary cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling `load_pem_pkcs7_certificates` or `load_der_pkcs7_certificates` could lead to a NULL-pointer dereference and segfault. Exploitation of this vulnerability poses a serious risk of Denial of Service (DoS) for any application attempting to deserialize a PKCS7 blob/certificate. The consequences extend to potential disruptions in system availability and stability. This vulnerability has been patched in version 41.0.6.
Status Published
Exploitability 0.5
Weighted Severity 6.8
Risk 3.4
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-476 NULL Pointer Dereference
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 7.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-49083.json
epss 0.00445 https://api.first.org/data/v1/epss?cve=CVE-2023-49083
epss 0.00445 https://api.first.org/data/v1/epss?cve=CVE-2023-49083
epss 0.00445 https://api.first.org/data/v1/epss?cve=CVE-2023-49083
epss 0.00445 https://api.first.org/data/v1/epss?cve=CVE-2023-49083
epss 0.00457 https://api.first.org/data/v1/epss?cve=CVE-2023-49083
epss 0.00457 https://api.first.org/data/v1/epss?cve=CVE-2023-49083
epss 0.00457 https://api.first.org/data/v1/epss?cve=CVE-2023-49083
epss 0.00457 https://api.first.org/data/v1/epss?cve=CVE-2023-49083
epss 0.00457 https://api.first.org/data/v1/epss?cve=CVE-2023-49083
epss 0.00457 https://api.first.org/data/v1/epss?cve=CVE-2023-49083
epss 0.00457 https://api.first.org/data/v1/epss?cve=CVE-2023-49083
epss 0.00457 https://api.first.org/data/v1/epss?cve=CVE-2023-49083
epss 0.00457 https://api.first.org/data/v1/epss?cve=CVE-2023-49083
epss 0.00457 https://api.first.org/data/v1/epss?cve=CVE-2023-49083
epss 0.00457 https://api.first.org/data/v1/epss?cve=CVE-2023-49083
epss 0.00457 https://api.first.org/data/v1/epss?cve=CVE-2023-49083
epss 0.0059 https://api.first.org/data/v1/epss?cve=CVE-2023-49083
epss 0.0059 https://api.first.org/data/v1/epss?cve=CVE-2023-49083
epss 0.0059 https://api.first.org/data/v1/epss?cve=CVE-2023-49083
epss 0.0059 https://api.first.org/data/v1/epss?cve=CVE-2023-49083
epss 0.0059 https://api.first.org/data/v1/epss?cve=CVE-2023-49083
epss 0.0059 https://api.first.org/data/v1/epss?cve=CVE-2023-49083
epss 0.00603 https://api.first.org/data/v1/epss?cve=CVE-2023-49083
epss 0.00603 https://api.first.org/data/v1/epss?cve=CVE-2023-49083
epss 0.00603 https://api.first.org/data/v1/epss?cve=CVE-2023-49083
epss 0.00603 https://api.first.org/data/v1/epss?cve=CVE-2023-49083
epss 0.00603 https://api.first.org/data/v1/epss?cve=CVE-2023-49083
epss 0.00603 https://api.first.org/data/v1/epss?cve=CVE-2023-49083
cvssv3.1 5.5 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-jfhm-5ghh-2f97
cvssv3.1 5.9 https://github.com/pyca/cryptography
generic_textual MODERATE https://github.com/pyca/cryptography
cvssv3.1 5.9 https://github.com/pyca/cryptography/commit/f09c261ca10a31fe41b1262306db7f8f1da0e48a
cvssv3.1 7.5 https://github.com/pyca/cryptography/commit/f09c261ca10a31fe41b1262306db7f8f1da0e48a
generic_textual MODERATE https://github.com/pyca/cryptography/commit/f09c261ca10a31fe41b1262306db7f8f1da0e48a
cvssv3.1 5.9 https://github.com/pyca/cryptography/pull/9926
cvssv3.1 7.5 https://github.com/pyca/cryptography/pull/9926
generic_textual MODERATE https://github.com/pyca/cryptography/pull/9926
cvssv3.1 5.9 https://github.com/pyca/cryptography/security/advisories/GHSA-jfhm-5ghh-2f97
cvssv3.1 7.5 https://github.com/pyca/cryptography/security/advisories/GHSA-jfhm-5ghh-2f97
cvssv3.1_qr MODERATE https://github.com/pyca/cryptography/security/advisories/GHSA-jfhm-5ghh-2f97
generic_textual MODERATE https://github.com/pyca/cryptography/security/advisories/GHSA-jfhm-5ghh-2f97
cvssv3.1 5.9 https://github.com/pypa/advisory-database/tree/main/vulns/cryptography/PYSEC-2023-254.yaml
generic_textual MODERATE https://github.com/pypa/advisory-database/tree/main/vulns/cryptography/PYSEC-2023-254.yaml
cvssv3.1 5.9 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QMNTYMUGFJSDBYBU22FUYBHFRZODRKXV
generic_textual MODERATE https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QMNTYMUGFJSDBYBU22FUYBHFRZODRKXV
cvssv3.1 7.5 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QMNTYMUGFJSDBYBU22FUYBHFRZODRKXV/
cvssv3.1 5.9 https://nvd.nist.gov/vuln/detail/CVE-2023-49083
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2023-49083
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2023-49083
cvssv3.1 5.9 http://www.openwall.com/lists/oss-security/2023/11/29/2
generic_textual MODERATE http://www.openwall.com/lists/oss-security/2023/11/29/2
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-49083.json
https://api.first.org/data/v1/epss?cve=CVE-2023-49083
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-49083
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/pyca/cryptography
https://github.com/pyca/cryptography/commit/f09c261ca10a31fe41b1262306db7f8f1da0e48a
https://github.com/pyca/cryptography/pull/9926
https://github.com/pyca/cryptography/security/advisories/GHSA-jfhm-5ghh-2f97
https://github.com/pypa/advisory-database/tree/main/vulns/cryptography/PYSEC-2023-254.yaml
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QMNTYMUGFJSDBYBU22FUYBHFRZODRKXV
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QMNTYMUGFJSDBYBU22FUYBHFRZODRKXV/
https://nvd.nist.gov/vuln/detail/CVE-2023-49083
http://www.openwall.com/lists/oss-security/2023/11/29/2
1057108 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1057108
2255331 https://bugzilla.redhat.com/show_bug.cgi?id=2255331
cpe:2.3:a:cryptography.io:cryptography:*:*:*:*:*:python:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:cryptography.io:cryptography:*:*:*:*:*:python:*:*
GHSA-jfhm-5ghh-2f97 https://github.com/advisories/GHSA-jfhm-5ghh-2f97
RHSA-2024:10965 https://access.redhat.com/errata/RHSA-2024:10965
RHSA-2024:1878 https://access.redhat.com/errata/RHSA-2024:1878
RHSA-2024:2337 https://access.redhat.com/errata/RHSA-2024:2337
RHSA-2024:3105 https://access.redhat.com/errata/RHSA-2024:3105
RHSA-2024:3781 https://access.redhat.com/errata/RHSA-2024:3781
RHSA-2025:13098 https://access.redhat.com/errata/RHSA-2025:13098
RHSA-2025:13100 https://access.redhat.com/errata/RHSA-2025:13100
RHSA-2025:13101 https://access.redhat.com/errata/RHSA-2025:13101
RHSA-2025:13102 https://access.redhat.com/errata/RHSA-2025:13102
RHSA-2025:13103 https://access.redhat.com/errata/RHSA-2025:13103
RHSA-2025:13104 https://access.redhat.com/errata/RHSA-2025:13104
RHSA-2025:14553 https://access.redhat.com/errata/RHSA-2025:14553
RHSA-2025:15874 https://access.redhat.com/errata/RHSA-2025:15874
USN-6539-1 https://usn.ubuntu.com/6539-1/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-49083.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/pyca/cryptography
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/pyca/cryptography/commit/f09c261ca10a31fe41b1262306db7f8f1da0e48a
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/pyca/cryptography/commit/f09c261ca10a31fe41b1262306db7f8f1da0e48a
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/pyca/cryptography/pull/9926
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/pyca/cryptography/pull/9926
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/pyca/cryptography/security/advisories/GHSA-jfhm-5ghh-2f97
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/pyca/cryptography/security/advisories/GHSA-jfhm-5ghh-2f97
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/pypa/advisory-database/tree/main/vulns/cryptography/PYSEC-2023-254.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QMNTYMUGFJSDBYBU22FUYBHFRZODRKXV
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QMNTYMUGFJSDBYBU22FUYBHFRZODRKXV/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2023-49083
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2023-49083
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Found at http://www.openwall.com/lists/oss-security/2023/11/29/2
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.6247
EPSS Score 0.00445
Published At July 30, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T08:24:11.811967+00:00 Pypa Importer Import https://github.com/pypa/advisory-database/blob/main/vulns/cryptography/PYSEC-2023-254.yaml 37.0.0