OpenKMIP PyKMIP version All versions before 0.8.0 contains a CWE 399: Resource Management…
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 2 without a fix
Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.
Summary
OpenKMIP PyKMIP version All versions before 0.8.0 contains a CWE 399: Resource Management Errors (similar issue to CVE-2015-5262) vulnerability in PyKMIP server that can result in DOS: the server can be made unavailable by one or more clients opening all of the available sockets. This attack appear to be exploitable via A client or clients open sockets with the server and then never close them. This vulnerability appears to have been fixed in 0.8.0.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | pykmip (PyPI) | before 0.8.0 | 0.8.0 | Patch available | GHSA-gfv6-cj92-g3hx |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- pykmip (PyPI) Vendor— Affected before 0.8.0 Fixed in 0.8.0 Patch available GHSA-gfv6-cj92-g3hx
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:pykmip_project:pykmip:*:*:*:*:*:*:*:* | before 0.8.0 | Vulnerable | Pykmip Project |
- cpe:2.3:a:pykmip_project:pykmip:*:*:*:*:*:*:*:* Versions before 0.8.0 Vulnerable ·Pykmip Project
Remediation
- Fix · GHSA-gfv6-cj92-g3hx pykmip (PyPI) Fixed in 0.8.0 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenStack Platform 13 (Queens) | Affected | No fix yet: Fix deferred |
| Red Hat OpenStack Platform 14 (Rocky) | Affected | No fix yet |
Timeline
- 2026-10-02 Threatist record created from CVE-2018-1000872
- 2026-10-03 Alias added: GHSA-gfv6-cj92-g3hx
References
Advisory 2
Sources
- CVE-2018-1000872 · CVE Program
- CVE-2018-1000872 · NVD
- FIRST EPSS
- GHSA-gfv6-cj92-g3hx · GitHub Advisory Database · CC BY 4.0
- CVE-2018-1000872 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences