CVE-2018-1000807: PyOpenSSL Use-After-Free vulnerability
8.1
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.88745%
CWE
Published
10/10/2018
Updated
10/15/2024
KEV Status
No
Technology
Python
PythonTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| pyopenssl | pip | < 17.5.0 | 17.5.0 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The commit diff shows critical changes in X509 object handling:
- In SSL.py's verify callback wrapper, the original code created X509 objects via new + direct _x509 assignment without calling X509_up_ref, leaving Python objects referencing potentially freed memory.
- In crypto.py's PKCS12 loading, X509 objects were constructed from OpenSSL stack pointers without proper reference counting, causing leaks and UAF. The fixes introduced X509_up_ref and _from_raw_x509_ptr to manage ownership correctly. The vulnerability manifests when applications retain references to these improperly managed X509 objects.