chore(deps): update dependency cryptography to v41.0.6 [security]
Metadata
Current evaluation
Merged PR #1396 upgraded cryptography from 41.0.4 to 41.0.6 via commit d8a889db, fixing the PKCS#7 NULL-pointer denial-of-service vulnerability CVE-2023-49083.
Resolution: closed resolved
Reason: The approved dependency security update was merged as commit d8a889db, addressing CVE-2023-49083 by upgrading cryptography to 41.0.6.
Evaluated by: mr-cal-bot
No scores available.
Issue body
[](https://renovatebot.com)
This PR contains the following updates:
| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [cryptography](https://togithub.com/pyca/cryptography) ([changelog](https://cryptography.io/en/latest/changelog/)) | `==41.0.4` -> `==41.0.6` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) |
### GitHub Vulnerability Alerts
#### [CVE-2023-49083](https://togithub.com/pyca/cryptography/security/advisories/GHSA-jfhm-5ghh-2f97)
### Summary
Calling `load_pem_pkcs7_certificates` or `load_der_pkcs7_certificates` could lead to a NULL-pointer dereference and segfault.
### PoC
Here is a Python code that triggers the issue:
```python
from cryptography.hazmat.primitives.serialization.pkcs7 import load_der_pkcs7_certificates, load_pem_pkcs7_certificates
pem_p7 = b"""
-----BEGIN PKCS7-----
MAsGCSqGSIb3DQEHAg==
-----END PKCS7-----
"""
der_p7 = b"\x30\x0B\x06\x09\x2A\x86\x48\x86\xF7\x0D\x01\x07\x02"
load_pem_pkcs7_certificates(pem_p7)
load_der_pkcs7_certificates(der_p7)
```
### Impact
Exploitation of this vulnerability poses a serious risk of Denial of Service (DoS) for any application attempting to deserialize a PKCS7 blob/certificate. The consequences extend to potential disruptions in system availability and stability.
---
### Release Notes
<details>
<summary>pyca/cryptography (cryptography)</summary>
### [`v41.0.6`](https://togithub.com/pyca/cryptography/compare/41.0.5...41.0.6)
[Compare Source](https://togithub.com/pyca/cryptography/compare/41.0.5...41.0.6)
### [`v41.0.5`](https://togithub.com/pyca/cryptography/compare/41.0.4...41.0.5)
[Compare Source](https://togithub.com/pyca/cryptography/compare/41.0.4...41.0.5)
</details>
---
### Configuration
📅 **Schedule**: Branch creation - "" in timezone Etc/UTC, Automerge - "before 07:00" in timezone Etc/UTC.
🚦 **Automerge**: Enabled.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/canonical/charmcraft).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy41OS44IiwidXBkYXRlZEluVmVyIjoiMzcuNTkuOCIsInRhcmdldEJyYW5jaCI6Im1haW4ifQ==-->
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Merged PR #1396 upgraded cryptography from 41.0.4 to 41.0.6 via commit d8a889db, fixing the PKCS#7 NULL-pointer denial-of-service vulnerability CVE-2023-49083. | |
| stealth/space-bunny-alpha | — | closed resolved | Renovate security bump of cryptography 41.0.4 -> 41.0.6, fixing CVE-2023-49083 (PKCS#7 NULL-pointer/segfault DoS), was approved and merged into main in commit d8a889db. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged security update of cryptography from 41.0.4 to 41.0.6, addressing CVE-2023-49083 (PKCS#7 NULL-pointer/segfault DoS), in commit d8a889db. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged PR #1396 (commit d8a889db), upgrading cryptography 41.0.4→41.0.6 to address CVE-2023-49083, a PKCS7 parsing NULL-pointer denial-of-service vulnerability. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged automated dependency update upgrading cryptography from 41.0.4 to 41.0.6 to resolve CVE-2023-49083, preventing a denial of service from NULL-pointer dereference during PKCS7 parsing. Approved and merged automatically by Renovate. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged automated dependency update upgrading cryptography from 41.0.4 to 41.0.6 to resolve CVE-2023-49083, a PKCS7 deserialization crash. Applied via Renovate bot automerge. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #1164 chore(deps): update dependency cryptography to v41.0.2 [security] | charmcraft | merged | Merged cryptography 41.0.2 security update via commit 6d9dd818, replacing 41.0.0 to address CVE-2023-38325. | |
| #1201 chore(deps): update dependency cryptography to v41.0.3 [security] | charmcraft | merged | Merged as commit 31f7281c, updating cryptography from 41.0.2 to 41.0.3 to address vulnerable OpenSSL bundled in its wheels. | |
| #4564 chore(deps): update dependency cryptography to v42 [security] | snapcraft | merged | Renovate bumped cryptography from 41.0.7 to 42.0.2 (fixing CVE-2023-50782 and CVE-2024-0727); PR #4564 was approved and squash-merged into main as commit ac421ab96. | |
| #4598 chore(deps): update dependency cryptography to v42.0.4 [security] | snapcraft | merged | Merged #4598 in commit 7cfb60986, upgrading cryptography from 42.0.2 to 42.0.4 to address CVE-2024-26130. | |
| #1120 chore(deps): update dependency cryptography to v41 [security] - autoclosed | charmcraft | closed | Autoclosed unmerged; the same cryptography 40.0.2→41.0.0 security update was merged via #1119 in commit 42365b41. | |
| #1272 chore(deps): update dependency cryptography to v41.0.4 [security] | charmcraft | closed | Renovate security bump of cryptography 41.0.3 -> 41.0.4 was closed unmerged by @lengau on 2023-09-21 (flaky store test) in favour of #1271, which landed as commit 431c7387. | |
| #1529 chore(deps): update dependency cryptography to v42.0.2 [security] | charmcraft | merged | Renovate security bump of cryptography 42.0.1 -> 42.0.2 (CVE-2024-0727 PKCS12 DoS) merged to main as commit f80f2cd4, a 2-line requirements.txt pin change. | |
| #1537 chore(deps): update dependency cryptography to v42.0.4 [security] | charmcraft | closed | Renovate PR to bump cryptography 42.0.2->42.0.4 (CVE-2024-26130) was closed unmerged by lengau on 2024-02-22, deferred to a separate env-var change; the pin later moved to 42.0.5 via merged #1601 (545b8db5) and 42.0.8 in #1694. | |
| #1057 chore(deps): update dependency cryptography [security] - autoclosed | charmcraft | closed | Renovate’s cryptography 3.4.8→39/40 update was autoclosed unmerged; PR #1119 (commit 42365b41) later merged 40.0.2→41.0.0, superseding it. | |
| #1056 chore(deps): update dependency cryptography to v39 [security] | charmcraft | closed | Renovate's cryptography 3.4.8->39.0.1 security bump was closed unmerged; maintainer lengau pointed to #1024, which merged as commit 96f6a183 upgrading to 39.0 (plus Rust build deps) and closing #991. |