chore(deps): update dependency cryptography to v41.0.6 [security]
Metadata
Current evaluation
Merged automated dependency update upgrading cryptography from 41.0.4 to 41.0.6 to resolve CVE-2023-49083, preventing a denial of service from NULL-pointer dereference during PKCS7 parsing. Approved and merged automatically by Renovate.
Suggested action: —
No scores available.
Issue body
[](https://renovatebot.com)
This PR contains the following updates:
| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [cryptography](https://togithub.com/pyca/cryptography) ([changelog](https://cryptography.io/en/latest/changelog/)) | `==41.0.4` -> `==41.0.6` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) |
### GitHub Vulnerability Alerts
#### [CVE-2023-49083](https://togithub.com/pyca/cryptography/security/advisories/GHSA-jfhm-5ghh-2f97)
### Summary
Calling `load_pem_pkcs7_certificates` or `load_der_pkcs7_certificates` could lead to a NULL-pointer dereference and segfault.
### PoC
Here is a Python code that triggers the issue:
```python
from cryptography.hazmat.primitives.serialization.pkcs7 import load_der_pkcs7_certificates, load_pem_pkcs7_certificates
pem_p7 = b"""
-----BEGIN PKCS7-----
MAsGCSqGSIb3DQEHAg==
-----END PKCS7-----
"""
der_p7 = b"\x30\x0B\x06\x09\x2A\x86\x48\x86\xF7\x0D\x01\x07\x02"
load_pem_pkcs7_certificates(pem_p7)
load_der_pkcs7_certificates(der_p7)
```
### Impact
Exploitation of this vulnerability poses a serious risk of Denial of Service (DoS) for any application attempting to deserialize a PKCS7 blob/certificate. The consequences extend to potential disruptions in system availability and stability.
---
### Release Notes
<details>
<summary>pyca/cryptography (cryptography)</summary>
### [`v41.0.6`](https://togithub.com/pyca/cryptography/compare/41.0.5...41.0.6)
[Compare Source](https://togithub.com/pyca/cryptography/compare/41.0.5...41.0.6)
### [`v41.0.5`](https://togithub.com/pyca/cryptography/compare/41.0.4...41.0.5)
[Compare Source](https://togithub.com/pyca/cryptography/compare/41.0.4...41.0.5)
</details>
---
### Configuration
📅 **Schedule**: Branch creation - "" in timezone Etc/UTC, Automerge - "before 07:00" in timezone Etc/UTC.
🚦 **Automerge**: Enabled.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/canonical/charmcraft).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy41OS44IiwidXBkYXRlZEluVmVyIjoiMzcuNTkuOCIsInRhcmdldEJyYW5jaCI6Im1haW4ifQ==-->
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen/qwen3.6-35b-a3b | — | — | Merged automated dependency update upgrading cryptography from 41.0.4 to 41.0.6 to resolve CVE-2023-49083, preventing a denial of service from NULL-pointer dereference during PKCS7 parsing. Approved and merged automatically by Renovate. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged automated dependency update upgrading cryptography from 41.0.4 to 41.0.6 to resolve CVE-2023-49083, a PKCS7 deserialization crash. Applied via Renovate bot automerge. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged automated dependency update upgrading cryptography from v41.0.4 to v41.0.6 to patch CVE-2023-49083, a NULL-pointer dereference vulnerability in PKCS7 parsing. Applied via Renovate automerge. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #1164 chore(deps): update dependency cryptography to v41.0.2 [security] | charmcraft | merged | Merged automated dependency update upgrading cryptography from v41.0.0 to v41.0.2 to resolve CVE-2023-38325 SSH certificate vulnerability. Approved, passed CI checks, and successfully merged via Renovate bot. | |
| #4598 chore(deps): update dependency cryptography to v42.0.4 [security] | snapcraft | merged | Merged automated dependency update upgrading cryptography from v42.0.2 to v42.0.4. This resolves CVE-2024-26130, fixing a NULL pointer dereference crash during pkcs12 serialization. Approved, passed CI, and merged successfully. | |
| #4564 chore(deps): update dependency cryptography to v42 [security] | snapcraft | merged | Merged automated dependency update upgrading cryptography from v41.0.7 to v42.0.2 to patch CVE-2023-50782 and CVE-2024-0727. The change passed CI checks, received two approvals, and was merged into main. | |
| #1529 chore(deps): update dependency cryptography to v42.0.2 [security] | charmcraft | merged | Merged automated update upgrading cryptography from 42.0.1 to 42.0.2 to patch CVE-2024-0727, preventing OpenSSL crashes from malformed PKCS12 files. Approved by two reviewers, passed CI, and merged automatically. | |
| #1201 chore(deps): update dependency cryptography to v41.0.3 [security] | charmcraft | merged | Merged automated update upgrading cryptography from v41.0.2 to v41.0.3 to resolve OpenSSL vulnerabilities in prebuilt wheels. Approved, passed CI, and auto-merged. | |
| #1537 chore(deps): update dependency cryptography to v42.0.4 [security] | charmcraft | closed | Maintainer closed the cryptography v42.0.4 security update without merging. The patch requires an environment variable change and will be handled separately. Renovate will ignore this specific version. | |
| #1019 chore(deps): update dependency cryptography to v39 [security] | charmcraft | closed | Superseded by PR #1024. The automated cryptography v39 security update was closed unmerged to prevent duplication with a newer dependency upgrade. | |
| #1120 chore(deps): update dependency cryptography to v41 [security] - autoclosed | charmcraft | closed | The cryptography v41 security update pull request was autoclosed without merging. Renovate automatically closed it due to inactivity or because the dependency was already updated. No reviews or CI checks were performed. | |
| #1056 chore(deps): update dependency cryptography to v39 [security] | charmcraft | closed | Closed unmerged and superseded by PR #1024, which addresses the cryptography v39 security update. Renovate will ignore future 39.x releases for this branch. | |
| #1272 chore(deps): update dependency cryptography to v41.0.4 [security] | charmcraft | closed | Closed without merging after failing a flaky store test. Superseded by PR #1271. Renovate will ignore this cryptography v41.0.4 update until a newer version is released. |