Pyopenssl Incorrect Memory Management

中 5.9CVE-2018-1000808 · GHSA-2rcm-phc9-3945 · PYSEC-2018-24 · 08/10/2018 公開 · 17/06/2026 更新

要点

CVE-2018-1000808 は pyopenssl, pyopenssl (pyopenssl project), gluster storage (redhat) に影響する深刻度「中」 (CVSS 5.9) の脆弱性です。
今後30日間に悪用される確率（EPSS）：1.9%（全脆弱性の 79.6% より高い）。
対処：17.5.0 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
pyopenssl PyPI	`< 17.5.0`	`17.5.0`
pyopenssl pyopenssl_project	`< 17.5.0`	`17.5.0`
gluster storage redhat	`= 3.0`	修正版なし
openstack redhat	`= 13`	修正版なし

概要

It was discovered that pyOpenSSL incorrectly handled memory when performing operations on a PKCS #12 store. A remote attacker could possibly use this issue to cause pyOpenSSL to consume resources, resulting in a denial of service.

This attack appear to be exploitable via Depends upon calling application, however it could be as simple as initiating a TLS connection that would cause the calling application to reload certificates from a PKCS #12 store. This vulnerability appears to have been fixed in 17.5.0.

NVD の説明

Python Cryptographic Authority pyopenssl version Before 17.5.0 contains a CWE - 401 : Failure to Release Memory Before Removing Last Reference vulnerability in PKCS #12 Store that can result in Denial of service if memory runs low or is exhausted. This attack appear to be exploitable via Depends upon calling application, however it could be as simple as initiating a TLS connection. Anything that would cause the calling application to reload certificates from a PKCS #12 store.. This vulnerability appears to have been fixed in 17.5.0.