Pyopenssl Incorrect Memory Management

It was discovered that pyOpenSSL incorrectly handled memory when performing operations on a PKCS 12 store. A remote attacker could possibly use this issue to cause pyOpenSSL to consume resources, resulting in a denial of service. This attack appear to be exploitable via Depends upon calling...

Remote Code Execution (RCE)

pyopenssl is vulnerable to remote code execution. A Use-After-Free UAF vulnerability exists in the X509 object handling which can be remotely exploited to cause a denial of service condition or execute arbitrary code...

Denial Of Service (DoS)

pyopenssl is vulnerable to denial of service DoS attacks. The vulnerability exists due to the lack of releasing the memory of the PKCS 12 Store where reloading certificates from the PKCS 12 store could cause a DoS attack...

burp-ui (>=0.5.0, <=0.5.1), chakraversiontracker (>=1.2.1.20160901, <=1.2.1.20160917) +36 more potentially affected by CVE-2018-1000807 via pyopenssl (>=17.0.0, <=17.4.0)

pyopenssl PYPI version =17.0.0, =0.5.0, =1.2.1.20160901, =0.5.0, =0.3.0, =0.2.4, =0.9.2, =0.9.7, =1.3.12, =0.2.0, =1.3.13, =2.2.0, =1.15.0, =1.15.0, =1.15.0, =1.15.0, =1.27.0 and more Source cves: CVE-2018-1000807 Source advisory: OSV:PYSEC-2018-23...

certbot-pinned (0.17.0), crossbar (17.3.1) +43 more potentially affected by CVE-2018-1000808 via pyopenssl (16.2.0)

pyopenssl PYPI version 16.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on pyopenssl and may be impacted: - certbot-pinned 0.17.0 - crossbar 17.3.1 - django-afip =2.2.0, =1.9.5, =1.1.1, =1.0.2, =1.0.2, =1.0.2, =0.0.1, =0.0.1, =1.0.2, =1.0.2, =1.0.3...

toughradius (>=0.9.4, <=0.9.6), traffic (2.6.2) potentially affected by CVE-2018-1000808 via pyopenssl (0.14.0)

pyopenssl PYPI version 0.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on pyopenssl and may be impacted: - toughradius =0.9.4, =0.9.6 - traffic 2.6.2 Source cves: CVE-2018-1000808 Source advisory: OSV:PYSEC-2018-24...

Design/Logic Flaw

Python Cryptographic Authority pyopenssl version prior to version 17.5.0 contains a CWE-416: Use After Free vulnerability in X509 object handling that can result in Use after free can lead to possible denial of service or remote code execution.. This attack appear to be exploitable via Depends on...

certbot-pinned (0.17.0), crossbar (17.3.1) +43 more potentially affected by CVE-2018-1000807 via pyopenssl (16.2.0)

pyopenssl PYPI version 16.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on pyopenssl and may be impacted: - certbot-pinned 0.17.0 - crossbar 17.3.1 - django-afip =2.2.0, =1.9.5, =1.1.1, =1.0.2, =1.0.2, =1.0.2, =0.0.1, =0.0.1, =1.0.2, =1.0.2, =1.0.3...

toughradius (>=0.9.4, <=0.9.6), traffic (2.6.2) potentially affected by CVE-2018-1000807 via pyopenssl (0.14.0)

pyopenssl PYPI version 0.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on pyopenssl and may be impacted: - toughradius =0.9.4, =0.9.6 - traffic 2.6.2 Source cves: CVE-2018-1000807 Source advisory: OSV:PYSEC-2018-23...

PYSEC-2018-24

Python Cryptographic Authority pyopenssl version Before 17.5.0 contains a CWE - 401 : Failure to Release Memory Before Removing Last Reference vulnerability in PKCS 12 Store that can result in Denial of service if memory runs low or is exhausted. This attack appear to be exploitable via Depends...

Memory corruption

Python Cryptographic Authority pyopenssl version Before 17.5.0 contains a CWE - 401 : Failure to Release Memory Before Removing Last Reference vulnerability in PKCS 12 Store that can result in Denial of service if memory runs low or is exhausted. This attack appear to be exploitable via Depends...

burp-ui (>=0.4.1, <=0.4.4), data-pipeline (>=0.9.5, <=0.9.12) +1 more potentially affected by CVE-2018-1000808 via pyopenssl (16.0.0)

pyopenssl PYPI version 16.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pyopenssl and may be impacted: - burp-ui =0.4.1, =0.9.5, =0.2.10.3, =0.2.10.4 Source cves: CVE-2018-1000808 Source advisory: OSV:PYSEC-2018-24...

burp-ui (>=0.5.0, <=0.5.1), chakraversiontracker (>=1.2.1.20160901, <=1.2.1.20160917) +36 more potentially affected by CVE-2018-1000808 via pyopenssl (>=17.0.0, <=17.4.0)

pyopenssl PYPI version =17.0.0, =0.5.0, =1.2.1.20160901, =0.5.0, =0.3.0, =0.2.4, =0.9.2, =0.9.7, =1.3.12, =0.2.0, =1.3.13, =2.2.0, =1.15.0, =1.15.0, =1.15.0, =1.15.0, =1.27.0 and more Source cves: CVE-2018-1000808 Source advisory: OSV:PYSEC-2018-24...

PYSEC-2018-23

Python Cryptographic Authority pyopenssl version prior to version 17.5.0 contains a CWE-416: Use After Free vulnerability in X509 object handling that can result in Use after free can lead to possible denial of service or remote code execution.. This attack appear to be exploitable via Depends on...

DEBIAN-CVE-2018-1000808

Python Cryptographic Authority pyopenssl version Before 17.5.0 contains a CWE - 401 : Failure to Release Memory Before Removing Last Reference vulnerability in PKCS 12 Store that can result in Denial of service if memory runs low or is exhausted. This attack appear to be exploitable via Depends...

DEBIAN-CVE-2018-1000807

Python Cryptographic Authority pyopenssl version prior to version 17.5.0 contains a CWE-416: Use After Free vulnerability in X509 object handling that can result in Use after free can lead to possible denial of service or remote code execution.. This attack appear to be exploitable via Depends on...

python-glanceclient (0.14.3) potentially affected by CVE-2018-1000808 via pyopenssl (0.13.0)

pyopenssl PYPI version 0.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on pyopenssl and may be impacted: - python-glanceclient 0.14.3 Source cves: CVE-2018-1000808 Source advisory: OSV:PYSEC-2018-24...

CVE-2018-1000807

Python Cryptographic Authority pyopenssl version prior to version 17.5.0 contains a CWE-416: Use After Free vulnerability in X509 object handling that can result in Use after free can lead to possible denial of service or remote code execution.. This attack appear to be exploitable via Depends on...

CVE-2018-1000808

Python Cryptographic Authority pyopenssl version Before 17.5.0 contains a CWE - 401 : Failure to Release Memory Before Removing Last Reference vulnerability in PKCS 12 Store that can result in Denial of service if memory runs low or is exhausted. This attack appear to be exploitable via Depends...

CVE-2018-1000808

Python Cryptographic Authority pyopenssl version Before 17.5.0 contains a CWE - 401 : Failure to Release Memory Before Removing Last Reference vulnerability in PKCS 12 Store that can result in Denial of service if memory runs low or is exhausted. This attack appear to be exploitable via Depends...