GHSA-2rcm-phc9-3945

Suggest an improvement
Source
https://github.com/advisories/GHSA-2rcm-phc9-3945
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-2rcm-phc9-3945/GHSA-2rcm-phc9-3945.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-2rcm-phc9-3945
Aliases
Published
2018-10-10T16:10:23Z
Modified
2024-02-20T05:20:00.745238Z
Severity
  • 5.9 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Pyopenssl Incorrect Memory Management
Details

It was discovered that pyOpenSSL incorrectly handled memory when performing operations on a PKCS #12 store. A remote attacker could possibly use this issue to cause pyOpenSSL to consume resources, resulting in a denial of service.

This attack appear to be exploitable via Depends upon calling application, however it could be as simple as initiating a TLS connection that would cause the calling application to reload certificates from a PKCS #12 store. This vulnerability appears to have been fixed in 17.5.0.

References

Affected packages

PyPI / pyopenssl

Package

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
17.5.0

Affected versions

0.*

0.6
0.7
0.8
0.9
0.10
0.11
0.12
0.13
0.13.1
0.14
0.15
0.15.1

16.*

16.0.0
16.1.0
16.2.0

17.*

17.0.0
17.1.0
17.2.0
17.3.0
17.4.0