GHSA-6vqw-3v5j-54x4HighCVSS 7.5

cryptography NULL pointer dereference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override

Published
February 21, 2024
Last Modified
March 18, 2026

🔗 CVE IDs covered (1)

CVE-2024-26130 →

📋 Description

If pkcs12.serialize_key_and_certificates is called with both:

  1. A certificate whose public key did not match the provided private key
  2. An encryption_algorithm with hmac_hash set (via PrivateFormat.PKCS12.encryption_builder().hmac_hash(...)

Then a NULL pointer dereference would occur, crashing the Python process.

This has been resolved, and now a ValueError is properly raised.

Patched in https://github.com/pyca/cryptography/pull/10423

🎯 Affected products1

  • pip/cryptography:>= 38.0.0, < 42.0.4

🔗 References (6)