CVE-2018-1000808: canonical ubuntu_linux Improper Resource Shutdown or Release
Vulnerability summary
CVE-2018-1000808 is a medium (CVSS 5.9) Improper Resource Shutdown or Release vulnerability in canonical ubuntu_linux. EPSS estimates a 1.90% chance of exploitation in the next 30 days, higher than 79.2% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 5 · Related 4Timeline
- 08-10-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
Python Cryptographic Authority pyopenssl version Before 17.5.0 contains a CWE - 401 : Failure to Release Memory Before Removing Last Reference vulnerability in PKCS #12 Store that can result in Denial of service if memory runs low or is exhausted. This attack appear to be exploitable via Depends upon calling application, however it could be as simple as initiating a TLS connection. Anything that would cause the calling application to reload certificates from a PKCS #12 store.. This vulnerability appears to have been fixed in 17.5.0.
CVSS metrics
7 scores · 5 sources · 3 versions- OSV · AlpineEcosystem advisory · calculated5.9MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · PypiEcosystem advisory · calculated5.9MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated5.9MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated5.9MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
1.90%
Chance of exploitation in the next 30 days
Percentile
79%
Versus all other CVEs
30-day change
0.00 pp
From 1.90% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Redhat5 products
Alpine1 product
- py-openssl< 17.5.0-r0
Canonical1 product
- ubuntu_linuxEOL16.04
Debian1 product
- pyopenssl< 17.5.0-1
Pyopenssl_project1 product
- pyopenssl< 17.5.0
PyPI1 product
- pyopenssl< 17.5.0
Ubuntu1 product
- pyopenssl< 0.15.1-2ubuntu0.2
7 vendors · 11 products
References
15 links- access.redhat.com/errata/RHSA-2019:0085Vendor AdvisoryX Refsource REDHATThird Party AdvisoryWEBAdvisory
- lists.opensuse.org/opensuse-security-announce/2019-04/msg00014.htmlVendor AdvisoryX Refsource SUSEWEB
- github.com/pyca/pyopensslPACKAGE
