CVE-2019-5010 PoC — Python X509证书解析器代码问题漏洞

Source

https://github.com/JonathanWilbur/CVE-2019-5010

Associated Vulnerability

Title: Python X509证书解析器代码问题漏洞 (CVE-2019-5010)
Description:An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6. A specially crafted X509 certificate can cause a NULL pointer dereference, resulting in a denial of service. An attacker can initiate or accept TLS connections using crafted certificates to trigger this vulnerability.

Description

CVE-2019-5010 Exploit PoC - Python Denial of Service via Malformed X.509v3 Extension

Readme

# CVE-2019-5010

* Author: [Jonathan M. Wilbur](https://github.com/JonathanWilbur) <[jonathan@wilbur.space](mailto:jonathan@wilbur.space)>
* Copyright Year: 2019
* License: [MIT License](https://mit-license.org/)

## How to use

1. Install all dependencies by running `npm install`.
2. Compile the project using `npm run build`.
3. Run `node ./dist/index.js` to create the evil certificate in `./dist/cve-2019-5010-cert.pem`.
4. Bring up the victim container with `docker-compose up`.

This is honestly probably the most unimpressive exploit ever. The docker
container will crash with exit code 139 if you are successful and 0 if
the exploit does not work.

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →