~ / search / GHSA-p28m-34f6-967q

GHSA-p28m-34f6-967q

PyOpenSSL Use-After-Free vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2018-1000807

Packages

EcosystemPackageAffectedFixed in
PyPI pyopenssl < 17.5.0 17.5.0

Details

As written in the advisory (Markdown source, shown as plain text).

It was discovered that pyOpenSSL incorrectly handled memory when handling X509 objects. A remote attacker could use this issue to cause pyOpenSSL to crash, resulting in a denial of service, or possibly execute arbitrary code. This attack appears to be exploitable via Depends on the calling application and if it retains a reference to the memory. This vulnerability appears to have been fixed in 17.5.0.

References

External links from the advisory. They lead to third-party sites.