5.9

CVE-2018-1000808

Python Cryptographic Authority pyopenssl version Before 17.5.0 contains a CWE - 401 : Failure to Release Memory Before Removing Last Reference vulnerability in PKCS #12 Store that can result in Denial of service if memory runs low or is exhausted. This attack appear to be exploitable via Depends upon calling application, however it could be as simple as initiating a TLS connection. Anything that would cause the calling application to reload certificates from a PKCS #12 store.. This vulnerability appears to have been fixed in 17.5.0.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Pyopenssl Project ≫ Pyopenssl Version < 17.5.0
Canonical ≫ Ubuntu Linux Version 16.04 SwEdition lts
Redhat ≫ Gluster Storage Version 3.0
Redhat ≫ Openstack Version 13
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.9% 0.769
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 5.9 2.2 3.6
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
NIST 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:N/A:P
CWE-404 Improper Resource Shutdown or Release

The product does not release or incorrectly releases a resource before it is made available for re-use.

http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00014.html
https://access.redhat.com/errata/RHSA-2019:0085
Third Party Advisory
https://github.com/pyca/pyopenssl/pull/723
Patch
Third Party Advisory
https://usn.ubuntu.com/3813-1/
Third Party Advisory