The pyca cryptography package versions >=45.0.0 and <46.0.7 contain a buffer overflow vulnerability (CWE-119, CWE-131) triggered by passing non-contiguous buffers to APIs that accept Python buffers (e.g., Hash.update()). This improper restriction of operations within memory buffer bounds can lead to out-of-bounds reads or writes, potentially causing crashes or denial of service. The issue is resolved in version 46.0.7. Red Hat advisories confirm the vulnerability and note that mitigation options are limited, but the impact is constrained by service process isolation. The CVSS v3.1 base score is 7.3 (Red Hat) and 9.8 (NVD), indicating a medium to high severity depending on the environment.

Exploitation of this vulnerability can cause a denial of service via application crash due to buffer overflow. There is potential for arbitrary code execution or memory disclosure if the buffer overflow is leveraged further, but the primary confirmed impact is denial of service. In Red Hat environments, the impact is limited to the compromised service account due to process isolation. No active exploits have been reported in the wild.

A fixed version 46.0.7 of the pyca cryptography package is available and should be applied to remediate this vulnerability. Red Hat has released security advisories and updated packages for affected products including Red Hat Ansible Automation Platform 2.5. No effective mitigations other than upgrading are currently available or meet Red Hat's criteria. Users should upgrade to version 46.0.7 or later to resolve this issue.