SB2026080116 - Multiple vulnerabilities in python-cryptography

Description

This security bulletin contains information about 2 vulnerabilities.

1) Resource exhaustion (CVE-ID: N/A)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in the certificate chain path-building logic when processing invalid certificate chains containing duplicate self-signed certificates. A remote attacker can supply a crafted certificate chain to cause a denial of service.

The issue affects availability only; certificate validation correctness is not affected.

2) Improper Certificate Validation (CVE-ID: N/A)

CWE-ID: CWE-295 - Improper Certificate Validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to spoof certificate identity validation.

The vulnerability exists due to improper certificate validation in the certificate verifier when processing certificate chains with wildcard DNS subject alternative names under permitted subtrees constraints. A remote attacker can present a specially crafted certificate chain to spoof certificate identity validation.

The issue occurs when an intermediate constrained CA permits a specific DNS name such as foo.example.com, but a leaf certificate uses a broader wildcard DNS SAN such as *.example.com.

Remediation

Install update from vendor's website.

References

• https://github.com/pyca/cryptography/security/advisories/GHSA-jwv3-5hgf-82ww
• https://github.com/pyca/cryptography/security/advisories/GHSA-m2h6-j472-rp4c