Pyopenssl Incorrect Memory Management

TRUNG BÌNH 5.9CVE-2018-1000808 · GHSA-2rcm-phc9-3945 · PYSEC-2018-24 · Công bố 08/10/2018 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2018-1000808 là lỗ hổng mức TRUNG BÌNH (CVSS 5.9) ảnh hưởng pyopenssl, pyopenssl (pyopenssl project), gluster storage (redhat).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 1.9%, cao hơn 79.6% các lỗ hổng khác.
Cách xử lý: cập nhật lên 17.5.0 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
pyopenssl PyPI	`< 17.5.0`	`17.5.0`
pyopenssl pyopenssl_project	`< 17.5.0`	`17.5.0`
gluster storage redhat	`= 3.0`	Chưa có bản vá
openstack redhat	`= 13`	Chưa có bản vá

Mô tả

It was discovered that pyOpenSSL incorrectly handled memory when performing operations on a PKCS #12 store. A remote attacker could possibly use this issue to cause pyOpenSSL to consume resources, resulting in a denial of service.

This attack appear to be exploitable via Depends upon calling application, however it could be as simple as initiating a TLS connection that would cause the calling application to reload certificates from a PKCS #12 store. This vulnerability appears to have been fixed in 17.5.0.

Mô tả của NVD

Python Cryptographic Authority pyopenssl version Before 17.5.0 contains a CWE - 401 : Failure to Release Memory Before Removing Last Reference vulnerability in PKCS #12 Store that can result in Denial of service if memory runs low or is exhausted. This attack appear to be exploitable via Depends upon calling application, however it could be as simple as initiating a TLS connection. Anything that would cause the calling application to reload certificates from a PKCS #12 store.. This vulnerability appears to have been fixed in 17.5.0.