Vulnerability CVE-2018-1000807


Published: 2018-10-08

Description:
Python Cryptographic Authority pyopenssl version prior to version 17.5.0 contains a CWE-416: Use After Free vulnerability in X509 object handling that can result in Use after free can lead to possible denial of service or remote code execution.. This attack appear to be exploitable via Depends on the calling application and if it retains a reference to the memory.. This vulnerability appears to have been fixed in 17.5.0.

Type:

CWE-416

(Use After Free)

CVSS2 => (AV:N/AC:M/Au:N/C:P/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
6.8/10
6.4/10
8.6/10
Exploit range
Attack complexity
Authentication
Remote
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial
Affected software
Redhat -> Openstack 
Redhat -> Enterprise linux desktop 
Redhat -> Enterprise linux server 
Redhat -> Enterprise linux workstation 
Pyopenssl -> Pyopenssl 
Canonical -> Ubuntu linux 

 References:
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00014.html
https://access.redhat.com/errata/RHSA-2019:0085
https://github.com/pyca/pyopenssl/pull/723
https://usn.ubuntu.com/3813-1/

Copyright 2024, cxsecurity.com

 

Back to Top