# CVE-2018-1000808: pyOpenSSL incorrect memory management in PKCS #12 handling

Source: https://junglewise.ai/threats/cve-2018-1000808-pyopenssl-incorrect-memory-management-in-pkcs-12-handling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2018-10-08. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2018-1000808 · Severity: low · CVSS 3 · Published 2018-10-08

pyOpenSSL is a Python cryptography library used by applications to manage SSL/TLS certificates and cryptographic keys. The library incorrectly managed memory when processing PKCS #12 certificate stores, causing memory leaks and potential use-after-free conditions. An attacker could trigger this vulnerability by initiating a TLS connection that causes an application to reload certificates, leading to resource exhaustion and denial of service.

Technologies: [pyopenssl (PyPI)](https://junglewise.ai/threats/technologies/pypi-pyopenssl). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2018-1000808 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2018-1000808 being exploited in the wild.

**How severe is CVE-2018-1000808?** Low severity, with a CVSS score of 3, published 8 October 2018.

**Which products and versions are affected?** pyopenssl (PyPI) ECOSYSTEM:introduced=0,fixed=17.5.0.

**Is there a fix for CVE-2018-1000808?** Yes. pyopenssl (PyPI): upgrade to 17.5.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2018-1000808 attacked?** It is attacked over the network.

**Am I affected by CVE-2018-1000808?** Check whether you run pyopenssl (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- pyopenssl (PyPI): upgrade to 17.5.0 or later

  ```sh
  pip install "pyopenssl>=17.5.0"
  ```


## Technical details

The vulnerability is a memory management error (CWE-401, CWE-404) in pyOpenSSL's handling of PKCS #12 stores. The root cause involves two separate issues: (1) a memory leak where PKCS #12 objects with CA certificates freed the stack but not the underlying X.509 objects, and (2) a potential use-after-free condition in callback handling where X509 objects were created without owning their own memory. The attack is network-reachable and requires no authentication or user interaction—a remote attacker can trigger the vulnerability by initiating a TLS connection that causes the target application to reload certificates from a PKCS #12 store. Successful exploitation results in resource exhaustion and denial of service. The vulnerability was fixed in pyOpenSSL version 17.5.0.

## Affected products

- pyca pyOpenSSL before 17.5.0

## Identifiers

- CVE-2018-1000808
- GHSA-2rcm-phc9-3945
- PYSEC-2018-24

## Timeline

- 2018-10-08: disclosed
- 2017-11-30: patched: Fix merged in PR #723
- 2018-10-10: advisory

## References

- [https://github.com/pyca/pyopenssl/pull/723](https://github.com/pyca/pyopenssl/pull/723)

## Related threats

- [pyOpenSSL buffer overflow in DTLS cookie generation callback](https://junglewise.ai/threats/cve-2026-27459-pyopenssl-buffer-overflow-in-dtls-cookie-generation-callback)
- [pyOpenSSL allows TLS connection bypass via unhandled callback exception in set_tlsext_servername_callback](https://junglewise.ai/threats/cve-2026-27448-pyopenssl-allows-tls-connection-bypass-via-unhandled-callback)
- [PyOpenSSL Use-After-Free vulnerability](https://junglewise.ai/threats/cve-2018-1000807-pyopenssl-use-after-free-vulnerability)
- [PyOpenSSL Mishandles NUL Byte In Certificate Subject Alternative Name](https://junglewise.ai/threats/cve-2013-4314-pyopenssl-mishandles-nul-byte-in-certificate-subject-alternative)