Read the docs
TI-2018-16032 Aliases CVE-2018-1000808GHSA-2rcm-phc9-3945

Python Cryptographic Authority pyopenssl version Before 17.5.0 contains a CWE - 401…

Priority LOW 30CWE-404Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 1 fixed, 8 without a fix

Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-404.

Summary

Python Cryptographic Authority pyopenssl version Before 17.5.0 contains a CWE - 401 : Failure to Release Memory Before Removing Last Reference vulnerability in PKCS #12 Store that can result in Denial of service if memory runs low or is exhausted. This attack appear to be exploitable via Depends upon calling application, however it could be as simple as initiating a TLS connection. Anything that would cause the calling application to reload certificates from a PKCS #12 store.. This vulnerability appears to have been fixed in 17.5.0.

Why it matters now

EPSS 0.01895 79th percentileScored 2026-11-07
Fix Partial pyopenssl (PyPI): 17.5.0Red Hat: 1 advisoryRed Hat: 1 fixed, 8 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—pyopenssl (PyPI)before 17.5.017.5.0Patch availableGHSA-2rcm-phc9-3945
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • pyopenssl (PyPI) Vendor— Affected before 17.5.0 Fixed in 17.5.0 Patch available GHSA-2rcm-phc9-3945

CPE configurations NVD · 7

CPEVersionsRoleVendor
cpe:2.3:a:pyopenssl_project:pyopenssl:*:*:*:*:*:*:*:*before 17.5.0VulnerablePyopenssl Project
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*16.04VulnerableCanonical
cpe:2.3:a:redhat:gluster_storage:3.0:*:*:*:*:*:*:*3.0VulnerableRed Hat
cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:*13VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
  • cpe:2.3:a:pyopenssl_project:pyopenssl:*:*:*:*:*:*:*:* Versions before 17.5.0 Vulnerable ·Pyopenssl Project
  • cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* Versions 16.04 Vulnerable ·Canonical
  • cpe:2.3:a:redhat:gluster_storage:3.0:*:*:*:*:*:*:* Versions 3.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:* Versions 13 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat

Remediation

  • Fix · GHSA-2rcm-phc9-3945 pyopenssl (PyPI) Fixed in 17.5.0 Advisory →

Red Hat 1 advisory

  • RHSA-2019:0085 Released 2019-01-16 · Red Hat rating Moderate
    pyOpenSSL security and bug fix update
    • Red Hat OpenStack Platform 13.0 pyOpenSSL-17.5.0-1.el7ost, python2-pyOpenSSL-17.5.0-1.el7ost

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 5AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 7AffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 10 (Newton)AffectedNo fix yet: Fix deferred
Red Hat OpenStack Platform 12 (Pike)AffectedNo fix yet: Fix deferred
Red Hat OpenStack Platform 14 (Rocky)AffectedNo fix yet
Red Hat Storage 3AffectedNo fix yet: Fix deferred
Red Hat Virtualization 4AffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 13.0Fixed RHSA-2019:0085
Not affected: 1 product
  • Red Hat Enterprise Linux 8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-1000808
  2. 2026-10-03 Alias added: GHSA-2rcm-phc9-3945

References

Patch 1

Advisory 5

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences