fix CVE-2024-26130

backport-CVE-2024-26130.patch

@@ -0,0 +1,63 @@
+From fc9611c3260f4d38a87227febf43d758938a8a75 Mon Sep 17 00:00:00 2001
+From: Alex Gaynor <alex.gaynor@gmail.com>
+Date: Mon, 19 Feb 2024 11:50:28 -0500
+Subject: [PATCH] Fixes #10422 -- don't crash when a PKCS#12 key and cert don't
+ match (#10423)
+
+---
+ .../hazmat/backends/openssl/backend.py         |  9 +++++++++
+ tests/hazmat/primitives/test_pkcs12.py         | 18 ++++++++++++++++++
+ 2 files changed, 27 insertions(+)
+
+diff --git a/src/cryptography/hazmat/backends/openssl/backend.py b/src/cryptography/hazmat/backends/openssl/backend.py
+index 5d9eb27..12fbebe 100644
+--- a/src/cryptography/hazmat/backends/openssl/backend.py
++++ b/src/cryptography/hazmat/backends/openssl/backend.py
+@@ -826,6 +826,15 @@ class Backend:
+                     mac_iter,
+                     0,
+                 )
++                if p12 == self._ffi.NULL:
++                    errors = self._consume_errors()
++                    raise ValueError(
++                        (
++                            "Failed to create PKCS12 (does the key match the "
++                            "certificate?)"
++                        ),
++                        errors,
++                    )
+ 
+             if (
+                 self._lib.Cryptography_HAS_PKCS12_SET_MAC
+diff --git a/tests/hazmat/primitives/test_pkcs12.py b/tests/hazmat/primitives/test_pkcs12.py
+index cd9c279..cd7bcaf 100644
+--- a/tests/hazmat/primitives/test_pkcs12.py
++++ b/tests/hazmat/primitives/test_pkcs12.py
+@@ -657,6 +657,24 @@ class TestPKCS12Creation:
+                 b"name", cakey, cacert, [], algorithm
+             )
+ 
++    @pytest.mark.supported(
++        only_if=lambda backend: backend._lib.Cryptography_HAS_PKCS12_SET_MAC,
++        skip_message="Requires OpenSSL with PKCS12_set_mac",
++    )
++    def test_set_mac_key_certificate_mismatch(self, backend):
++        cacert, _ = _load_ca(backend)
++        key = ec.generate_private_key(ec.SECP256R1())
++        encryption = (
++            serialization.PrivateFormat.PKCS12.encryption_builder()
++            .hmac_hash(hashes.SHA256())
++            .build(b"password")
++        )
++
++        with pytest.raises(ValueError):
++            serialize_key_and_certificates(
++                b"name", key, cacert, [], encryption
++            )
++
+ 
+ @pytest.mark.skip_fips(
+     reason="PKCS12 unsupported in FIPS mode. So much bad crypto in it."
+-- 
+2.27.0
+

python-cryptography.spec

@@ -1,7 +1,7 @@
 %global pypi_name cryptography
 Name:           python-%{pypi_name}
 Version:        42.0.2
-Release:        1
+Release:        2
 Summary:        PyCA's cryptography library
 License:        ASL 2.0 or BSD
 URL:            https://cryptography.io/en/latest/  
@@ -14,6 +14,7 @@ Source0:        %{pypi_source %{pypi_name}}
 Source1:        cargo-vendor-cache.tar.gz
 
 Patch6002:      backport-provide-openssl-apis-related-to-SM-for-python.patch
+Patch6003:      backport-CVE-2024-26130.patch
 
 BuildRequires:  openssl-devel cargo
 BuildRequires:  gcc
@@ -86,6 +87,9 @@ EOF
 %doc README.rst docs
 
 %changelog
+* Tue Feb 27 2024 shixuantong <shixuantong1@huawei.com> - 42.0.2-2
+- fix CVE-2024-26130
+
 * Thu Feb 01 2024 shixuantong <shixuantong1@huawei.com> - 42.0.2-1
 - upgrade version to 42.0.2