CVE-2024-26130: Cryptography.io Cryptography DOS Vulnerability

CVE-2024-26130 Overview

CVE-2024-26130 is a null pointer dereference vulnerability in the Python cryptography package, a widely-used library that provides cryptographic primitives and recipes to Python developers. The vulnerability exists in versions 38.0.0 through 42.0.3 and can be triggered when calling pkcs12.serialize_key_and_certificates with a mismatched certificate/private key pair while using specific HMAC hash encryption options.

Critical Impact

This vulnerability enables remote attackers to crash Python processes through a null pointer dereference, resulting in denial of service conditions for applications that rely on the cryptography library for PKCS#12 operations.

Affected Products

• cryptography.io cryptography versions >= 38.0.0 and < 42.0.4
• Python applications using pkcs12.serialize_key_and_certificates with HMAC hash encryption
• Systems running vulnerable versions of the cryptography package from PyPI

Discovery Timeline

• 2024-02-21 - CVE-2024-26130 published to NVD
• 2025-02-05 - Last updated in NVD database

Technical Details for CVE-2024-26130

Vulnerability Analysis

The vulnerability resides in the PKCS#12 serialization functionality within the cryptography library. When developers serialize keys and certificates to the PKCS#12 format, the library performs validation to ensure the provided certificate's public key matches the private key being serialized. However, when the encryption_algorithm parameter is configured with an hmac_hash value (set via PrivateFormat.PKCS12.encryption_builder().hmac_hash(...)), a specific code path is executed that fails to properly handle the mismatch condition.

Instead of raising an appropriate ValueError exception when detecting the key mismatch, the vulnerable code path attempts to dereference a null pointer, causing an immediate crash of the Python process. This represents a failure in defensive programming practices where error conditions should be handled gracefully rather than causing program termination.

Root Cause

The root cause is a missing null pointer check in the PKCS#12 serialization code path when HMAC hash encryption is enabled (CWE-476: Null Pointer Dereference). The code assumes certain internal structures are properly initialized when the HMAC hash option is specified, but when a certificate/key mismatch occurs, these structures may remain null. The fix in version 42.0.4 properly validates inputs and raises a ValueError exception before attempting operations that could dereference null pointers.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by:

1. Providing input to an application that uses the cryptography library for PKCS#12 operations
2. Ensuring the input causes a call to pkcs12.serialize_key_and_certificates with a certificate whose public key does not match the provided private key
3. The encryption algorithm must be configured with hmac_hash set via the PrivateFormat.PKCS12.encryption_builder().hmac_hash(...) method

The vulnerability manifests when pkcs12.serialize_key_and_certificates is invoked with specific conditions: a mismatched certificate/private key pair combined with HMAC hash encryption settings. Rather than properly validating inputs and raising a ValueError, the code path leads to a null pointer dereference. For detailed technical analysis and the specific fix, refer to the GitHub Pull Request and GitHub Commit Details.

Detection Methods for CVE-2024-26130

Indicators of Compromise

• Unexpected Python process crashes with segmentation faults in production environments
• Application logs showing abrupt termination during PKCS#12 serialization operations
• Core dumps or crash reports referencing the cryptography library's PKCS#12 functions
• Increased frequency of service restarts for Python applications handling certificate operations

Detection Strategies

• Monitor for Python process crashes with null pointer dereference signatures in system logs
• Implement application-level logging around pkcs12.serialize_key_and_certificates calls to detect exploitation attempts
• Use software composition analysis (SCA) tools to identify vulnerable versions of the cryptography package in your environment
• Deploy runtime application self-protection (RASP) solutions to detect abnormal behavior in cryptographic operations

Monitoring Recommendations

• Configure process monitoring to alert on unexpected termination of Python services using the cryptography library
• Implement dependency scanning in CI/CD pipelines to flag vulnerable package versions before deployment
• Set up anomaly detection for certificate processing endpoints that may use PKCS#12 serialization
• Review application logs for patterns of failed cryptographic operations preceding crashes

How to Mitigate CVE-2024-26130

Immediate Actions Required

• Upgrade the cryptography package to version 42.0.4 or later immediately
• Audit all Python applications in your environment for usage of the vulnerable cryptography versions
• Implement input validation to ensure certificate and private key pairs match before calling serialization functions
• Consider implementing rate limiting on endpoints that process certificate-related requests

Patch Information

The vulnerability has been resolved in cryptography version 42.0.4, which properly raises a ValueError when a certificate/key mismatch is detected. The fix is available through the following resources:

• GitHub Security Advisory
• GitHub Pull Request
• GitHub Commit Details

Workarounds

• Add application-level validation to verify certificate public keys match private keys before calling pkcs12.serialize_key_and_certificates
• Wrap PKCS#12 serialization calls in exception handlers to gracefully manage potential crashes
• Temporarily disable HMAC hash encryption options in PrivateFormat.PKCS12.encryption_builder() if upgrading is not immediately possible
• Implement process supervision to automatically restart affected services if crashes occur

# Upgrade cryptography package to patched version
pip install --upgrade cryptography>=42.0.4

# Verify installed version
pip show cryptography | grep Version

# For requirements.txt, update the dependency
# cryptography>=42.0.4