cryptography NULL pointer deference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override

[sniffler-app]

Description

If pkcs12.serialize_key_and_certificates is called with both:

1. A certificate whose public key did not match the provided private key
2. An encryption_algorithm with hmac_hash set (via PrivateFormat.PKCS12.encryption_builder().hmac_hash(...)

Then a NULL pointer dereference would occur, crashing the Python process.

This has been resolved, and now a ValueError is properly raised.

Patched in pyca/cryptography#10423

Informations

Manifest Path: poetry.lock

Please look at dependabot report: https://github.com/lightspeed-hospitality/pre-commit-hooks/security/dependabot/19