{"action":"Upgrade cryptography to 41.0.6 or later.","affected":[{"fixed":"41.0.6","introduced":"3.1"}],"component":"cryptography","cve_ids":["CVE-2023-49083"],"ecosystem":"PyPI","epss":0.00985,"exploited":false,"fixed_versions":["41.0.6"],"ghsa_id":"GHSA-jfhm-5ghh-2f97","id":"tcs_01M5KGK552MPNWXFJR0SNBH0BX","modified_at":"2024-02-17T07:41:40.326359Z","published_at":"2023-11-29T19:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2023-254","https://github.com/pyca/cryptography/security/advisories/GHSA-jfhm-5ghh-2f97","https://github.com/pyca/cryptography/pull/9926","https://github.com/pyca/cryptography/commit/f09c261ca10a31fe41b1262306db7f8f1da0e48a","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QMNTYMUGFJSDBYBU22FUYBHFRZODRKXV/"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"PYSEC-2023-254","url":"https://osv.dev/vulnerability/PYSEC-2023-254"}],"summary":"cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling `load_pem_pkcs7_certificates` or `load_der_pkcs7_certificates` could lead to a NULL-poin"}