-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the _load_pkcs7_certificates function in the OpenSSL backend implementation. The commit diff shows a NULL-check was added to p7.d.sign to prevent dereferencing. This function is called by both load_pem_pkcs7_certificates and load_der_pkcs7_certificates, which are the user-facing APIs mentioned in the advisory. The root cause was the missing NULL check in this backend method when handling PKCS7 structures with empty certificate lists.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| cryptography | pip | >= 3.1, < 41.0.6 | 41.0.6 |