VYPR
← All advisories
High severityNVD Advisory· Published Oct 8, 2018· Updated Aug 5, 2024

CVE-2018-1000807

CVE-2018-1000807

Description

Python Cryptographic Authority pyopenssl version prior to version 17.5.0 contains a CWE-416: Use After Free vulnerability in X509 object handling that can result in Use after free can lead to possible denial of service or remote code execution.. This attack appear to be exploitable via Depends on the calling application and if it retains a reference to the memory.. This vulnerability appears to have been fixed in 17.5.0.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Use-after-free vulnerability in pyOpenSSL X509 object handling before version 17.5.0 could allow denial of service or remote code execution.

Vulnerability

A use-after-free vulnerability exists in pyOpenSSL's handling of X509 objects in versions prior to 17.5.0 [1][2]. The issue is categorized as CWE-416 and occurs when an application retains a reference to memory that has already been freed [1].

Exploitation

Exploitation depends on the calling application and whether it retains a reference to the freed memory [1]. An attacker may trigger the vulnerability remotely via specially crafted input, leading to a crash or potentially arbitrary code execution [4].

Impact

Successfully exploiting the use-after-free can result in denial of service (application crash) or remote code execution with the privileges of the affected application [1][4]. The exact impact varies based on how the memory is reused after being freed.

Mitigation

The vulnerability is fixed in pyOpenSSL version 17.5.0 [2][3]. Red Hat issued RHSA-2019:0085 for Red Hat OpenStack Platform 13.0 [3], and Ubuntu published USN-3813-1 in November 2018 [4]. Users should upgrade to 17.5.0 or later.

References
  1. NVD - CVE-2018-1000807
  2. fix a memory leak and a potential UAF and also #722 by reaperhulk · Pull Request #723 · pyca/pyopenssl
  3. https://access.redhat.com/errata/RHSA-2019:0085
  4. USN-3813-1: pyOpenSSL vulnerabilities | Ubuntu security notices | Ubuntu

AI Insight generated on May 22, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
pyopensslPyPI
< 17.5.017.5.0

Affected products

251

Patches

1
e73818600065

fix a memory leak and a potential UAF and also #722 (#723)

https://github.com/pyca/pyopensslPaul KehrerNov 30, 2017via ghsa
commit
6 files changed · +36 −11
  • CHANGELOG.rst+3 −3 modified
    @@ -11,7 +11,7 @@ The third digit is only for regressions.
 Backward-incompatible changes:
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
-*none*
+* The minimum ``cryptography`` version is now 2.1.4.
 
 
 Deprecations:
@@ -23,8 +23,8 @@ Deprecations:
 Changes:
 ^^^^^^^^
 
-
-*none*
+- Fixed a potential use-after-free in the verify callback and resolved a memory leak when loading PKCS12 files with ``cacerts``.
+  `#723 <https://github.com/pyca/pyopenssl/pull/723>`_
 
 ----
  • setup.py+1 −1 modified
    @@ -95,7 +95,7 @@ def find_meta(meta):
         package_dir={"": "src"},
         install_requires=[
             # Fix cryptographyMinimum in tox.ini when changing this!
-            "cryptography>=1.9",
+            "cryptography>=2.1.4",
             "six>=1.5.2"
         ],
         extras_require={
  • src/OpenSSL/crypto.py+3 −4 modified
    @@ -3058,8 +3058,7 @@ def load_pkcs12(buffer, passphrase=None):
         pycert = None
         friendlyname = None
     else:
-        pycert = X509.__new__(X509)
-        pycert._x509 = _ffi.gc(cert[0], _lib.X509_free)
+        pycert = X509._from_raw_x509_ptr(cert[0])
 
         friendlyname_length = _ffi.new("int*")
         friendlyname_buffer = _lib.X509_alias_get0(
@@ -3073,8 +3072,8 @@ def load_pkcs12(buffer, passphrase=None):
 
     pycacerts = []
     for i in range(_lib.sk_X509_num(cacerts)):
-        pycacert = X509.__new__(X509)
-        pycacert._x509 = _lib.sk_X509_value(cacerts, i)
+        x509 = _lib.sk_X509_value(cacerts, i)
+        pycacert = X509._from_raw_x509_ptr(x509)
         pycacerts.append(pycacert)
     if not pycacerts:
         pycacerts = None
  • src/OpenSSL/SSL.py+3 −2 modified
    @@ -309,8 +309,9 @@ def __init__(self, callback):
 
         @wraps(callback)
         def wrapper(ok, store_ctx):
-            cert = X509.__new__(X509)
-            cert._x509 = _lib.X509_STORE_CTX_get_current_cert(store_ctx)
+            x509 = _lib.X509_STORE_CTX_get_current_cert(store_ctx)
+            _lib.X509_up_ref(x509)
+            cert = X509._from_raw_x509_ptr(x509)
             error_number = _lib.X509_STORE_CTX_get_error(store_ctx)
             error_depth = _lib.X509_STORE_CTX_get_error_depth(store_ctx)
  • tests/test_ssl.py+25 −0 modified
    @@ -1279,6 +1279,31 @@ def callback(self, connection, *args):
 
         assert verify.connection is clientConnection
 
+    def test_x509_in_verify_works(self):
+        """
+        We had a bug where the X509 cert instantiated in the callback wrapper
+        didn't __init__ so it was missing objects needed when calling
+        get_subject. This test sets up a handshake where we call get_subject
+        on the cert provided to the verify callback.
+        """
+        serverContext = Context(TLSv1_METHOD)
+        serverContext.use_privatekey(
+            load_privatekey(FILETYPE_PEM, cleartextPrivateKeyPEM))
+        serverContext.use_certificate(
+            load_certificate(FILETYPE_PEM, cleartextCertificatePEM))
+        serverConnection = Connection(serverContext, None)
+
+        def verify_cb_get_subject(conn, cert, errnum, depth, ok):
+            assert cert.get_subject()
+            return 1
+
+        clientContext = Context(TLSv1_METHOD)
+        clientContext.set_verify(VERIFY_PEER, verify_cb_get_subject)
+        clientConnection = Connection(clientContext, None)
+        clientConnection.set_connect_state()
+
+        handshake_in_memory(clientConnection, serverConnection)
+
     def test_set_verify_callback_exception(self):
         """
         If the verify callback passed to `Context.set_verify` raises an
  • tox.ini+1 −1 modified
    @@ -10,7 +10,7 @@ extras =
 deps =
     coverage>=4.2
     cryptographyMaster: git+https://github.com/pyca/cryptography.git
-    cryptographyMinimum: cryptography<=1.9
+    cryptographyMinimum: cryptography==2.1.4
 setenv =
     # Do not allow the executing environment to pollute the test environment
     # with extra packages.

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

9

News mentions

0

No linked articles in our index yet.