Reaperhulk

**Name of the Vulnerable Software and Affected Versions** pyopenssl versions prior to 17.5.0 **Description** The issue is related to a Use After Free vulnerability in X509 object handling, which can result in denial of service or possible remote code execution. This attack appears to be exploitable via the calling application if it retains a reference to the memory. **Recommendations** For versions prior to 17.5.0, update to version 17.5.0 or later to resolve the issue. As a temporary workaround, consider restricting the handling of X509 objects to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** pyopenssl versions prior to 17.5.0 **Description** The issue is related to a memory management problem in the PKCS #12 Store of pyopenssl, which can lead to a denial of service if memory runs low or is exhausted. This can be exploited by initiating a TLS connection or any action that causes the calling application to reload certificates from a PKCS #12 store, potentially allowing a remote attacker to consume resources. The estimated number of potentially affected devices and details about real-world incidents are not provided. **Recommendations** For versions prior to 17.5.0, update to version 17.5.0 or later to resolve the issue. As a temporary workaround, consider restricting operations on PKCS #12 stores to minimize the risk of exploitation. Avoid initiating unnecessary TLS connections or actions that cause the calling application to reload certificates from a PKCS #12 store until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** python-cryptography versions 1.9.0 through 2.3 **Description** A flaw was found in the `finalize with tag` API, which did not enforce a minimum tag length. This allows an attacker to craft an invalid payload with a shortened tag, potentially leading to GCM tag forgeries and key leakage. If a user does not validate the input length prior to passing it to `finalize with tag`, an attacker could have a chance of passing the MAC check. **Recommendations** For python-cryptography versions 1.9.0 through 2.3, consider validating the input length prior to passing it to `finalize with tag` to prevent potential GCM tag forgeries and key leakage. As a temporary workaround, ensure that all tags passed to `finalize with tag` have a validated minimum length to minimize the risk of exploitation.