SUSE-SU-2024:0763-1: Security update for python-cryptography
This update for python-cryptography fixes the following issues: CVE-2024-26130: Fixed NULL pointer dereference in pkcs12.serializekeyandcertificates() (bsc#1220210).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
suse/python311-cryptographyto a version that resolves this vulnerability.Fixed in 41.0.3-150400.16.15.1 - Upgrade
Upgrade
suse/python-cryptography-debugsourceto a version that resolves this vulnerability.Fixed in 41.0.3-150400.16.15.1 - Upgrade
Upgrade
suse/python311-cryptography-debuginfoto a version that resolves this vulnerability.Fixed in 41.0.3-150400.16.15.1 - Upgrade
Upgrade
python-cryptographyto a version that resolves this vulnerability.Patch SUSE-2024-763=1 - Upgrade
Upgrade
python-cryptographyto a version that resolves this vulnerability.Patch SUSE-SLE-Module-Python3-15-SP5-2024-763=1 - Upgrade
Upgrade
python-cryptographyto a version that resolves this vulnerability.Patch openSUSE-SLE-15.5-2024-763=1
Event History
Frequently Asked Questions
What conditions are needed to trigger the crash?
The issue is in pkcs12.serialize_key_and_certificates() and is caused by a NULL pointer dereference. The provided data does not specify the precise input or application conditions required to reach the vulnerable code path.
Which SUSE platforms are listed as affected by this update?
The update lists openSUSE Leap 15.4 and 15.5, as well as SUSE Python 3 Module 15-SP5. Listed architectures include aarch64, ppc64le, s390x, and x86_64; Leap 15.4 also lists i586.
How can I determine whether a system needs this update?
Check whether the system runs one of the listed SUSE platforms and has python-cryptography or the listed Python 3.11 cryptography packages installed. The advisory data does not provide fixed package versions, so package-version comparison cannot be performed from this information alone.