CVE-2018-1000807
The MITRE CVE dictionary describes this issue as:
Python Cryptographic Authority pyopenssl version prior to version 17.5.0 contains a CWE-416: Use After Free vulnerability in X509 object handling that can result in Use after free can lead to possible denial of service or remote code execution.. This attack appear to be exploitable via Depends on the calling application and if it retains a reference to the memory.. This vulnerability appears to have been fixed in 17.5.0.
Find out more about CVE-2018-1000807 from the MITRE CVE dictionary dictionary and NIST NVD.
CVSS v3 metrics
NOTE: The following CVSS v3 metrics and score provided are preliminary and subject to review.
| CVSS3 Base Score | 8.1 |
|---|---|
| CVSS3 Base Metrics | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Attack Vector | Network |
| Attack Complexity | High |
| Privileges Required | None |
| User Interaction | None |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity Impact | High |
| Availability Impact | High |
Affected Packages State
| Platform | Package | State |
|---|---|---|
| Red Hat OpenStack Platform 13.0 (Queens) | pyOpenSSL | Affected |
| Red Hat OpenStack Platform 12.0 | pyOpenSSL | Affected |
| Red Hat OpenStack Platform 10 | pyOpenSSL | Affected |
| Red Hat Gluster Storage 3 | pyOpenSSL | Under investigation |
| Red Hat Enterprise Linux 7 | pyOpenSSL | Affected |
| Red Hat Enterprise Linux 6 | pyOpenSSL | Will not fix |
| Red Hat Enterprise Linux 5 | pyOpenSSL | Under investigation |
| RHEV Manager 3 | pyOpenSSL | Will not fix |
CVE description copyright © 2017, The MITRE Corporation