SB2019011615 - Red Hat update for pyOpenSSL

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2019011615

SB2019011615 - Red Hat update for pyOpenSSL

Published: January 16, 2019

Security Bulletin ID SB2019011615
Severity
High
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 50% Low 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Use-after-free error (CVE-ID: CVE-2018-1000807)

The vulnerability allows a remote attacker to cause DoS condition or execute arbitrary code on the target system.

The vulnerability exists due to use-after-free error during improper handling of X509 objects. A remote unauthenticated attacker can send a specially crafted request that submits malicious input, trigger memory corruption and cause the service to crash or execute arbitrary code with elevated privileges.

Successful exploitation of the vulnerability may result in system compromise.


2) Resource exhaustion (CVE-ID: CVE-2018-1000808)

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The vulnerability exists due to improper release of memory before removing the last reference in a Public Key Cryptography Standards (PKCS) #12 store. A remote unauthenticated attacker can send a specially crafted request that submits malicious input, exhaust memory resources and to cause the application to reload certificates from a PKCS #12 store.


Remediation

Install update from vendor's website.

References