Quick answers
- Is CVE-2018-1000808 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2018-1000808 being exploited in the wild.
- How severe is CVE-2018-1000808?
- Low severity, with a CVSS score of 3, published 8 October 2018.
- Which products and versions are affected?
- pyopenssl (PyPI) ECOSYSTEM:introduced=0,fixed=17.5.0.
- Is there a fix for CVE-2018-1000808?
- Yes. pyopenssl (PyPI): upgrade to 17.5.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2018-1000808 attacked?
- It is attacked over the network.
- Am I affected by CVE-2018-1000808?
- Check whether you run pyopenssl (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- pyopenssl (PyPI): upgrade to 17.5.0 or later
pip install "pyopenssl>=17.5.0"
Technical details
The vulnerability is a memory management error (CWE-401, CWE-404) in pyOpenSSL's handling of PKCS #12 stores. The root cause involves two separate issues: (1) a memory leak where PKCS #12 objects with CA certificates freed the stack but not the underlying X.509 objects, and (2) a potential use-after-free condition in callback handling where X509 objects were created without owning their own memory. The attack is network-reachable and requires no authentication or user interaction—a remote attacker can trigger the vulnerability by initiating a TLS connection that causes the target application to reload certificates from a PKCS #12 store. Successful exploitation results in resource exhaustion and denial of service. The vulnerability was fixed in pyOpenSSL version 17.5.0.
Affected products
- pyca pyOpenSSL before 17.5.0
Identifiers
- CVE-2018-1000808
- GHSA-2rcm-phc9-3945
- PYSEC-2018-24
Timeline
- 2018-10-08: disclosed
- 2017-11-30: patched: Fix merged in PR #723
- 2018-10-10: advisory