GHSA-2rcm-phc9-3945HighCVSS 5.9

Pyopenssl Incorrect Memory Management

Published
October 10, 2018
Last Modified
October 21, 2024

🔗 CVE IDs covered (1)

📋 Description

It was discovered that pyOpenSSL incorrectly handled memory when performing operations on a PKCS #12 store. A remote attacker could possibly use this issue to cause pyOpenSSL to consume resources, resulting in a denial of service.

This attack appear to be exploitable via Depends upon calling application, however it could be as simple as initiating a TLS connection that would cause the calling application to reload certificates from a PKCS #12 store. This vulnerability appears to have been fixed in 17.5.0.

🎯 Affected products1

  • pip/pyopenssl:< 17.5.0

🔗 References (8)