SB2017102904 - Multiple vulnerabilities in Python Cryptographic Authority pyopenssl

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2017102904

SB2017102904 - Multiple vulnerabilities in Python Cryptographic Authority pyopenssl

Published: October 29, 2017

Security Bulletin ID SB2017102904
Severity
High
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 50% Low 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Resource exhaustion (CVE-ID: CVE-2018-1000808)

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The vulnerability exists due to improper release of memory before removing the last reference in a Public Key Cryptography Standards (PKCS) #12 store. A remote unauthenticated attacker can send a specially crafted request that submits malicious input, exhaust memory resources and to cause the application to reload certificates from a PKCS #12 store.


2) Use-after-free error (CVE-ID: CVE-2018-1000807)

The vulnerability allows a remote attacker to cause DoS condition or execute arbitrary code on the target system.

The vulnerability exists due to use-after-free error during improper handling of X509 objects. A remote unauthenticated attacker can send a specially crafted request that submits malicious input, trigger memory corruption and cause the service to crash or execute arbitrary code with elevated privileges.

Successful exploitation of the vulnerability may result in system compromise.


Remediation

Install update from vendor's website.

References