CVE-2018-1000807

HIGH EPSS 89.4%
Published Oct 8, 20187y ago · Modified Jun 17, 20262w ago
8.1 CVSS 3.1
High
Find Similar
Published Oct 8, 2018 7y ago
Last Modified Jun 17, 2026 2w ago

Description

Python Cryptographic Authority pyopenssl version prior to version 17.5.0 contains a CWE-416: Use After Free vulnerability in X509 object handling that can result in Use after free can lead to possible denial of service or remote code execution.. This attack appear to be exploitable via Depends on the calling application and if it retains a reference to the memory.. This vulnerability appears to have been fixed in 17.5.0.

CVSS Details

Base Score
8.1
Exploitability
2.2
Impact
5.9
Vector string
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector Network
Attack Complexity High
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
89.4% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-416 Use After Free Memory Safety

Affected Products 6

VendorProductVersionRange
pyopensslpyopenssl* <17.5.0
canonicalubuntu_linux16.04any
redhatopenstack13any
redhatenterprise_linux_desktop7.0any
redhatenterprise_linux_server7.0any
redhatenterprise_linux_workstation7.0any

References 5

  • lists.opensuse.org http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00014.html
    Mailing ListThird Party Advisory
  • access.redhat.com https://access.redhat.com/errata/RHSA-2019:0085
    Third Party Advisory
  • github.com https://github.com/pyca/pyopenssl/commit/e73818600065821d588af475b024f4eb518c3509
  • github.com https://github.com/pyca/pyopenssl/pull/723
    PatchThird Party Advisory
  • usn.ubuntu.com https://usn.ubuntu.com/3813-1/
    Third Party Advisory

Remediation

  • github.com https://github.com/pyca/pyopenssl/pull/723
    PatchThird Party Advisory