Описание
Python Cryptographic Authority pyopenssl version Before 17.5.0 contains a CWE - 401 : Failure to Release Memory Before Removing Last Reference vulnerability in PKCS #12 Store that can result in Denial of service if memory runs low or is exhausted. This attack appear to be exploitable via Depends upon calling application, however it could be as simple as initiating a TLS connection. Anything that would cause the calling application to reload certificates from a PKCS #12 store.. This vulnerability appears to have been fixed in 17.5.0.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 5 | pyOpenSSL | Will not fix | ||
| Red Hat Enterprise Linux 6 | pyOpenSSL | Will not fix | ||
| Red Hat Enterprise Linux 7 | pyOpenSSL | Will not fix | ||
| Red Hat Enterprise Linux 8 | pyOpenSSL | Not affected | ||
| Red Hat OpenStack Platform 10 (Newton) | pyOpenSSL | Fix deferred | ||
| Red Hat OpenStack Platform 12 (Pike) | pyOpenSSL | Fix deferred | ||
| Red Hat OpenStack Platform 14 (Rocky) | pyOpenSSL | Affected | ||
| Red Hat Storage 3 | pyOpenSSL | Fix deferred | ||
| Red Hat Virtualization 4 | pyOpenSSL | Will not fix | ||
| Red Hat OpenStack Platform 13.0 (Queens) | pyOpenSSL | Fixed | RHSA-2019:0085 | 16.01.2019 |
Показывать по
Дополнительная информация
Статус:
EPSS
3.7 Low
CVSS3
Связанные уязвимости
Python Cryptographic Authority pyopenssl version Before 17.5.0 contains a CWE - 401 : Failure to Release Memory Before Removing Last Reference vulnerability in PKCS #12 Store that can result in Denial of service if memory runs low or is exhausted. This attack appear to be exploitable via Depends upon calling application, however it could be as simple as initiating a TLS connection. Anything that would cause the calling application to reload certificates from a PKCS #12 store.. This vulnerability appears to have been fixed in 17.5.0.
Python Cryptographic Authority pyopenssl version Before 17.5.0 contains a CWE - 401 : Failure to Release Memory Before Removing Last Reference vulnerability in PKCS #12 Store that can result in Denial of service if memory runs low or is exhausted. This attack appear to be exploitable via Depends upon calling application, however it could be as simple as initiating a TLS connection. Anything that would cause the calling application to reload certificates from a PKCS #12 store.. This vulnerability appears to have been fixed in 17.5.0.
Python Cryptographic Authority pyopenssl version Before 17.5.0 contain ...
Security update for python-cryptography, python-pyOpenSSL
EPSS
3.7 Low
CVSS3