CVE-2018-1000872 PyKMIP Denial of service vulnerability
Attackers can cause denial of service in PyKMIP server by opening sockets without closing them, exhausting available resources.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2018-1000872?
CVE-2018-1000872 is a medium-severity denial of service vulnerability in n/a, published on 20 Dec 2018. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
OpenKMIP PyKMIP version All versions before 0.8.0 contains a CWE 399: Resource Management Errors (similar issue to CVE-2015-5262) vulnerability in PyKMIP server that can result in DOS: the server can be made unavailable by one or more clients opening all of the available sockets. This attack appear to be exploitable via A client or clients open sockets with the server and then never close them. This vulnerability appears to have been fixed in 0.8.0.
Weakness: CWE-400
Which versions are affected by CVE-2018-1000872?
3 open source packages ship an affected version, including pykmip. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
pykmip PyPI | All versions | 0.8.0 |
pykmip PyPI | All versions | 0.8.0 |
pykmip PyPI | All versions | 0.8.0 |
Linux distribution packages (3)
python-PyKMIP SUSE:HPE Helion OpenStack 8 | All versions | 0.6.0-3.3.1 |
python-PyKMIP SUSE:OpenStack Cloud 8 | All versions | 0.6.0-3.3.1 |
python-PyKMIP SUSE:OpenStack Cloud Crowbar 8 | All versions | 0.6.0-3.3.1 |
Products include Pykmip Project Pykmip.
How do I fix CVE-2018-1000872?
Upgrade pykmip to 0.8.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2018-1000872 being exploited?
There is no known exploitation of CVE-2018-1000872 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2018-1000872, GHSA-gfv6-cj92-g3hx, PYSEC-2018-22, SUSE-SU-2019:0391-1, UBUNTU-CVE-2018-1000872.