new file mode 100644
@@ -0,0 +1,66 @@
+From 97d231672763cdb5959a3b191e692a362f1b9e55 Mon Sep 17 00:00:00 2001
+From: Alex Gaynor <alex.gaynor@gmail.com>
+Date: Mon, 19 Feb 2024 11:50:28 -0500
+Subject: [PATCH] Fixes #10422 -- don't crash when a PKCS#12 key and cert don't
+match (#10423)
+
+Upstream-Status: Backport [https://github.com/pyca/cryptography/commit/97d231672763cdb5959a3b191e692a362f1b9e55]
+CVE: CVE-2024-26130
+Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
+---
+ .../hazmat/backends/openssl/backend.py | 9 +++++++++
+ tests/hazmat/primitives/test_pkcs12.py | 18 ++++++++++++++++++
+ 2 files changed, 27 insertions(+)
+
+diff --git a/src/cryptography/hazmat/backends/openssl/backend.py b/src/cryptography/hazmat/backends/openssl/backend.py
+index 7e9fa20..ce3fc8c 100644
+--- a/src/cryptography/hazmat/backends/openssl/backend.py
++++ b/src/cryptography/hazmat/backends/openssl/backend.py
+@@ -1046,6 +1046,15 @@ class Backend(object):
+ raise NotImplementedError(
+ 'Extension not supported: {}'.format(extension.oid)
+ )
++ if p12 == self._ffi.NULL:
++ errors = self._consume_errors()
++ raise ValueError(
++ (
++ "Failed to create PKCS12 (does the key match the "
++ "certificate?)"
++ ),
++ errors,
++ )
+
+ ext_struct = encode(self, extension.value)
+ nid = self._lib.OBJ_txt2nid(
+diff --git a/tests/hazmat/primitives/test_pkcs12.py b/tests/hazmat/primitives/test_pkcs12.py
+index f084d57..c4160b0 100644
+--- a/tests/hazmat/primitives/test_pkcs12.py
++++ b/tests/hazmat/primitives/test_pkcs12.py
+@@ -17,6 +17,24 @@ from cryptography.hazmat.primitives.serialization.pkcs12 import (
+
+ from .utils import load_vectors_from_file
+
++ @pytest.mark.supported(
++ only_if=lambda backend: backend._lib.Cryptography_HAS_PKCS12_SET_MAC,
++ skip_message="Requires OpenSSL with PKCS12_set_mac",
++ )
++ def test_set_mac_key_certificate_mismatch(self, backend):
++ cacert, _ = _load_ca(backend)
++ key = ec.generate_private_key(ec.SECP256R1())
++ encryption = (
++ serialization.PrivateFormat.PKCS12.encryption_builder()
++ .hmac_hash(hashes.SHA256())
++ .build(b"password")
++ )
++
++ with pytest.raises(ValueError):
++ serialize_key_and_certificates(
++ b"name", key, cacert, [], encryption
++ )
++
+
+ @pytest.mark.requires_backend_interface(interface=DERSerializationBackend)
+ class TestPKCS12(object):
+--
+2.25.1
+
@@ -15,6 +15,7 @@ SRC_URI += " \
file://0002-chunking-didn-t-actually-work-5499.patch \
file://0003-correct-buffer-overflows-cause-by-integer-overflow-i.patch \
file://CVE-2023-23931.patch \
+ file://CVE-2024-26130.patch \
"
inherit pypi setuptools3
Upstream-Status: Backport from https://github.com/pyca/cryptography/commit/97d231672763cdb5959a3b191e692a362f1b9e55 Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> --- .../python3-cryptography/CVE-2024-26130.patch | 66 +++++++++++++++++++ .../python/python3-cryptography_2.8.bb | 1 + 2 files changed, 67 insertions(+) create mode 100644 meta-python/recipes-devtools/python/python3-cryptography/CVE-2024-26130.patch