CVE-2018-1000808
pyOpenSSL: Failure to release memory before removing last reference in PKCS #12 Store
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Python Cryptographic Authority pyopenssl version Before 17.5.0 contains a CWE - 401 : Failure to Release Memory Before Removing Last Reference vulnerability in PKCS #12 Store that can result in Denial of service if memory runs low or is exhausted. This attack appear to be exploitable via Depends upon calling application, however it could be as simple as initiating a TLS connection. Anything that would cause the calling application to reload certificates from a PKCS #12 store.. This vulnerability appears to have been fixed in 17.5.0.
Python Cryptographic Authority pyopenssl en versiones anteriores a la 17.5.0 contiene una vulnerabilidad CWE - 401: Error al liberar memoria antes de eliminar la última referencia en PKCS #12 Store que puede resultar en una denegación de servicio (DoS) si hay poca memoria o ésta se agota. Este ataque parece ser explotable dependiendo de la aplicación llamante, aunque podría ser tan sencillo como iniciar una conexión TLS o cualquier cosa que haga que la aplicación llamante recargue certificados de un almacén PKCS #12. La vulnerabilidad parece haber sido solucionada en la versión 17.5.0.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2018-09-20 CVE Reserved
- 2018-10-08 CVE Published
- 2024-02-29 EPSS Updated
- 2024-08-05 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-400: Uncontrolled Resource Consumption
- CWE-404: Improper Resource Shutdown or Release
CAPEC
References (6)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://github.com/pyca/pyopenssl/pull/723 | 2021-08-04 |
| URL | Date | SRC |
|---|---|---|
| http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00014.html | 2021-08-04 | |
| https://access.redhat.com/errata/RHSA-2019:0085 | 2021-08-04 | |
| https://usn.ubuntu.com/3813-1 | 2021-08-04 | |
| https://access.redhat.com/security/cve/CVE-2018-1000808 | 2019-01-16 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1640216 | 2019-01-16 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Pyopenssl Project Search vendor "Pyopenssl Project" | Pyopenssl Search vendor "Pyopenssl Project" for product "Pyopenssl" | < 17.5.0 Search vendor "Pyopenssl Project" for product "Pyopenssl" and version " < 17.5.0" | - |
Affected
| ||||||
| Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 16.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "16.04" | lts |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Gluster Storage Search vendor "Redhat" for product "Gluster Storage" | 3.0 Search vendor "Redhat" for product "Gluster Storage" and version "3.0" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Openstack Search vendor "Redhat" for product "Openstack" | 13 Search vendor "Redhat" for product "Openstack" and version "13" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Enterprise Linux Desktop Search vendor "Redhat" for product "Enterprise Linux Desktop" | 7.0 Search vendor "Redhat" for product "Enterprise Linux Desktop" and version "7.0" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Enterprise Linux Server Search vendor "Redhat" for product "Enterprise Linux Server" | 7.0 Search vendor "Redhat" for product "Enterprise Linux Server" and version "7.0" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Enterprise Linux Workstation Search vendor "Redhat" for product "Enterprise Linux Workstation" | 7.0 Search vendor "Redhat" for product "Enterprise Linux Workstation" and version "7.0" | - |
Affected
| ||||||