CVE-2018-1000807

CWE-416: Use After Free in pyOpenSSL < 17.5.0 (Fixed in 17.5.0)

• CVSS 8.1
• CWE-416 Use After Free
• Memory Corruption
• Remote

Python Cryptographic Authority pyopenssl version prior to version 17.5.0 contains a CWE-416: Use After Free vulnerability in X509 object handling that can result in Use after free can lead to possible denial of service or remote code execution.. This attack appear to be exploitable via Depends on the calling application and if it retains a reference to the memory.. This vulnerability appears to have been fixed in 17.5.0.

CVE

CVE-2018-1000807

CWE

CWE-416 Use After Free

CVSS base score

8.1

Published

2018-10-08

OWASP

A08 Software and Data Integrity Failures

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Memory Corruption

Subcategory

Use-After-Free Errors

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Fixed by upgrading

Yes

Solution

Update to pyOpenSSL version 17.5.0 or higher.

from OpenSSL import crypto

def create_and_use_x509():
    # Create a new X509 certificate
    cert = crypto.X509()
    cert.set_version(2)  # Set version to X509v3
    cert.set_serial_number(1)  # Set a serial number

    # Simulate a scenario where the reference to the cert is lost
    # This could lead to use-after-free if the memory is reused
    del cert  # Explicitly delete the reference to the cert

    # Attempt to use the certificate after it has been deleted
    # This is where the vulnerability could be exploited
    try:
        print(cert)  # Accessing cert after deletion
    except NameError as e:
        print("Caught an error:", e)

# Run the function
create_and_use_x509()

from OpenSSL import crypto

# Example of creating and using an X509 object safely
def create_x509_certificate():
    # Create a new X509 certificate
    cert = crypto.X509()
    cert.set_version(2)  # Set version to X509v3
    cert.set_serial_number(1)  # Set a serial number
    # Normally, you would set the subject, issuer, and other fields here

    # Use the certificate safely
    # (No use-after-free vulnerability as we are not retaining references improperly)

    return cert

# Create an X509 certificate
certificate = create_x509_certificate()

# Use the certificate as needed
print(certificate)

@misc{vaitp:cve20181000807,
  title        = {{CWE-416: Use After Free in pyOpenSSL < 17.5.0 (Fixed in 17.5.0)}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2018},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2018-1000807},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2018-1000807/}}
}