SUSE-SU-2023:4843-1: Security update for python3-cryptography
This update for python3-cryptography fixes the following issues: CVE-2023-49083: Fixed a NULL pointer dereference when loading certificates from a PKCS#7 bundle (bsc#1217592).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
suse/python3-cryptography-debuginfoto a version that resolves this vulnerability.Fixed in 3.3.2-150400.23.1 - Upgrade
Upgrade
suse/python3-cryptography-debugsourceto a version that resolves this vulnerability.Fixed in 3.3.2-150400.23.1 - Upgrade
Upgrade
suse/python3-cryptographyto a version that resolves this vulnerability.Fixed in 3.3.2-150400.23.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Micro-5.3-2023-4843=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Micro-5.4-2023-4843=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Micro-5.5-2023-4843=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Module-Basesystem-15-SP4-2023-4843=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Module-Basesystem-15-SP5-2023-4843=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch openSUSE-Leap-Micro-5.3-2023-4843=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch openSUSE-Leap-Micro-5.4-2023-4843=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch openSUSE-SLE-15.4-2023-4843=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-2023-4843=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch openSUSE-SLE-15.5-2023-4843=1
Event History
Frequently Asked Questions
What systems are in scope for this update?
The update applies to python3-cryptography packages on openSUSE Leap 15.4 and 15.5, openSUSE Leap Micro 5.3 and 5.4, and SUSE Linux Enterprise Micro for Rancher 5.3. Affected architectures vary by product, with the listed platforms covering aarch64, ppc64le, s390x, x86_64, and, for Leap 15.4, i586.
What condition triggers the vulnerability?
The issue is triggered when certificates are loaded from a PKCS#7 bundle. The affected code can encounter a NULL pointer dereference during that operation.
How can I determine whether a system may be affected?
Check whether python3-cryptography is installed on one of the listed SUSE or openSUSE releases, and whether applications on that host load certificates from PKCS#7 bundles. The advisory also identifies associated debuginfo and debugsource packages as part of the update.