What is CVE-2018-1000808?

CVE-2018-1000808 is a medium-severity vulnerability in Pyopenssl Project, classified under Improper Resource Shutdown or Release. CVSS score: 5.9/10. Published 2018-10-08.

How severe is CVE-2018-1000808?

Medium severity. CVSS v3 base score is 5.9 out of 10.

Is CVE-2018-1000808 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Pyopenssl Project

CVE-2018-1000808

Python Cryptographic Authority pyopenssl version Before 17.5.0 contains a CWE - 401 : Failure to Release Memory Before Removing Last Reference vulnerability in PKCS #12 Store that can result in Denial of service if memory runs low or is exhausted. This attack appear to be exploitable via Depends upon calling application, however it could be as simple as initiating a TLS connection. Anything that would cause the calling application to reload certificates from a PKCS #12 store.. This vulnerability appears to have been fixed in 17.5.0.

Published 2018-10-08 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 5.9 (Medium). Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H.

EPSS exploit prediction

EPSS: 0.019 (79.5th percentile), scored 2026-10-23.

Low probability of exploitation in the next 30 days, but still tracked. 79th percentile — 79.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.019 · newest: 0.019 · change: 0.000

Affected products

Pyopenssl Project
Canonical Ubuntu Linux — versions 16.04
Red Hat Enterprise Linux Desktop — versions 7.0
Red Hat Enterprise Linux Server — versions 7.0
Red Hat Enterprise Linux Workstation — versions 7.0
Red Hat Gluster Storage — versions 3.0
Red Hat OpenStack — versions 13

Weakness classification (CWE)

CWE-404 — Improper Resource Shutdown or Release

Public proof-of-concept exploits

References

github.com/pyca/pyopenssl/pull/723 (Patch, Third Party Advisory)
access.redhat.com/errata/RHSA-2019:0085 (vendor-advisory, Third Party Advisory)
usn.ubuntu.com/3813-1/ (vendor-advisory, Third Party Advisory)
lists.opensuse.org/opensuse-security-announce/2019-04/msg00014.html (vendor-advisory)

Frequently asked questions

What is CVE-2018-1000808?: CVE-2018-1000808 is a medium-severity vulnerability in Pyopenssl Project, classified under Improper Resource Shutdown or Release. CVSS score: 5.9/10. Published 2018-10-08.
How severe is CVE-2018-1000808?: Medium severity. CVSS v3 base score is 5.9 out of 10.
Is CVE-2018-1000808 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.