Advisory Database
  • Advisories
  • Dependency Scanning
  1. pypi
  2. ›
  3. pyOpenSSL
  4. ›
  5. CVE-2018-1000808

CVE-2018-1000808: Pyopenssl Incorrect Memory Management

October 10, 2018 (updated October 21, 2024)

It was discovered that pyOpenSSL incorrectly handled memory when performing operations on a PKCS #12 store. A remote attacker could possibly use this issue to cause pyOpenSSL to consume resources, resulting in a denial of service.

This attack appear to be exploitable via Depends upon calling application, however it could be as simple as initiating a TLS connection that would cause the calling application to reload certificates from a PKCS #12 store. This vulnerability appears to have been fixed in 17.5.0.

References

  • access.redhat.com/errata/RHSA-2019:0085
  • github.com/advisories/GHSA-2rcm-phc9-3945
  • github.com/pyca/pyopenssl
  • github.com/pyca/pyopenssl/commit/e73818600065821d588af475b024f4eb518c3509
  • github.com/pyca/pyopenssl/pull/723
  • github.com/pypa/advisory-database/tree/main/vulns/pyopenssl/PYSEC-2018-24.yaml
  • nvd.nist.gov/vuln/detail/CVE-2018-1000808
  • usn.ubuntu.com/3813-1

Code Behaviors & Features

Detect and mitigate CVE-2018-1000808 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions before 17.5.0

Fixed versions

  • 17.5.0

Solution

Upgrade to version 17.5.0 or above.

Impact 5.9 MEDIUM

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Learn more about CVSS

Weakness

  • CWE-401: Missing Release of Memory after Effective Lifetime
  • CWE-404: Improper Resource Shutdown or Release

Source file

pypi/pyOpenSSL/CVE-2018-1000808.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Wed, 14 May 2025 12:16:02 +0000.