CVE-2018-1000808: pyopenssl - Failure to Release Memory Before Removing Last Reference
Summary
CVE-2018-1000808: Python Cryptographic Authority pyopenssl version Before 17.5.0 contains a CWE - 401 : Failure to Release Memory Before Removing Last Reference vulnerability in PKCS #12 Store that can result in Denial of service if memor... Affects pyopenssl versions < 17.5.0. Fixed in 17.5.0. How to fix ↓
Also tracked for
- py-openssl · Alpine:v3.6
The same CVE-2018-1000808 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
pyopenssl is a Python library that provides a high-level interface to the OpenSSL library. It allows Python programs to use SSL/TLS communication for secure connections. The library is widely used in various applications that require secure communication over the network. However, versions before 17.5.0 are vulnerable to a CWE-401 issue, where memory is not properly released before removing the last reference in the PKCS #12 Store. This vulnerability can lead to a denial of service if memory runs low or is exhausted. The vulnerability can be triggered by initiating a TLS connection or any action that causes the calling application to reload certificates from a PKCS #12 store.
Vulnerability Detail
The vulnerability in pyopenssl arises from a failure to release memory before removing the last reference in the PKCS #12 Store. This can result in a denial of service if memory becomes scarce or is completely exhausted. An attacker could exploit this vulnerability by initiating a TLS connection or triggering the reloading of certificates from a PKCS #12 store. The impact of this vulnerability can be severe, as it can lead to service disruptions or crashes in affected applications. The issue has been fixed in version 17.5.0 of pyopenssl.
How To Fix
Minimum fixed version
17.5.0
This is the first release that contains the fix.
pip install --upgrade "pyopenssl==17.5.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The vulnerability in pyopenssl (CVE-2018-1000808) can lead to a denial of service if memory becomes scarce or is exhausted. It is crucial to update pyopenssl to version 17.5.0 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pyopenssl →
FAQ
pyopenssl is a Python library that provides a high-level interface to the OpenSSL library, enabling secure communication over the network.
The vulnerability can result in a denial of service if memory becomes scarce or is exhausted, leading to service disruptions or crashes in affected applications.
The vulnerability can be exploited by initiating a TLS connection or triggering the reloading of certificates from a PKCS #12 store.
Yes, the vulnerability has been fixed in version 17.5.0 of pyopenssl.
You can update pyopenssl to the fixed version by running the command: pip install --upgrade pyopenssl
Related vulnerabilities
Recent vulnerabilities recorded for pyopenssl.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
