CVE-2018-1000808

CWE-401 in pyOpenSSL < 17.5.0: Memory Release Issue

• CVSS 5.9
• CWE-404 Improper Resource Shutdown or Release
• Resource Management
• Remote

Python Cryptographic Authority pyopenssl version Before 17.5.0 contains a CWE – 401 : Failure to Release Memory Before Removing Last Reference vulnerability in PKCS #12 Store that can result in Denial of service if memory runs low or is exhausted. This attack appear to be exploitable via Depends upon calling application, however it could be as simple as initiating a TLS connection. Anything that would cause the calling application to reload certificates from a PKCS #12 store.. This vulnerability appears to have been fixed in 17.5.0.

CVE

CVE-2018-1000808

CWE

CWE-404 Improper Resource Shutdown or Release

CVSS base score

5.9

Published

2018-10-08

OWASP

A06 Vulnerable and Outdated Components

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Resource Management

Subcategory

Memory Leaks

Accessibility scope

Remote

Impact

Denial of Service (DoS)

Fixed by upgrading

Yes

Solution

Update pyopenssl to version 17.5.0 or higher.

from OpenSSL import crypto

def load_pkcs12(p12_file, password):
    with open(p12_file, 'rb') as f:
        p12_data = f.read()
    
    p12 = crypto.load_pkcs12(p12_data, password)
    
    private_key = p12.get_privatekey()
    certificate = p12.get_certificate()
    
    return p12

from OpenSSL import crypto

def load_pkcs12(p12_file, password):
    with open(p12_file, 'rb') as f:
        p12_data = f.read()

    try:
        p12 = crypto.load_pkcs12(p12_data, password)
    except crypto.Error as e:
        raise ValueError("Failed to load PKCS12 file: " + str(e))
    
    private_key = p12.get_privatekey()
    certificate = p12.get_certificate()

    if private_key.bits() < 2048:
        raise ValueError("Private key is too weak. It must be at least 2048 bits.")
    
    store = crypto.X509Store()
    store.add_cert(certificate)
    try:
        store_ctx = crypto.X509StoreContext(store, certificate)
        store_ctx.verify_certificate()
    except crypto.X509StoreContextError as e:
        raise ValueError("Certificate is invalid: " + str(e))

    return p12

@misc{vaitp:cve20181000808,
  title        = {{CWE-401 in pyOpenSSL < 17.5.0: Memory Release Issue}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2018},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2018-1000808},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2018-1000808/}}
}