CVE-2018-1060 python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib's apop() method. An attacker could use this flaw to cause denial of service.
HighCVSS 7.5
EPSS 5.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib's apop() method. An attacker could use this flaw to cause denial of service.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/python2.7(Debian:11) | < 2.7.14-7 | 2.7.14-7 |
| alpine/python2(Alpine:v3.10) | < 2.7.15-r0 | 2.7.15-r0 |
| alpine/python2(Alpine:v3.11) | < 2.7.15-r0 | 2.7.15-r0 |
| alpine/python2(Alpine:v3.12) | < 2.7.15-r0 | 2.7.15-r0 |
| alpine/python2(Alpine:v3.13) | < 2.7.15-r0 | 2.7.15-r0 |
| alpine/python2(Alpine:v3.14) | < 2.7.15-r0 | 2.7.15-r0 |
| alpine/python2(Alpine:v3.15) | < 2.7.15-r0 | 2.7.15-r0 |
| alpine/python2(Alpine:v3.5) | < 2.7.15-r0 | 2.7.15-r0 |
| alpine/python2(Alpine:v3.6) | < 2.7.15-r0 | 2.7.15-r0 |
| alpine/python2(Alpine:v3.7) | < 2.7.15-r0 | 2.7.15-r0 |
| alpine/python2(Alpine:v3.9) | < 2.7.15-r0 | 2.7.15-r0 |
| alpine/python2-tkinter(Alpine:v3.10) | < 2.7.15-r0 | 2.7.15-r0 |
| alpine/python2-tkinter(Alpine:v3.11) | < 2.7.15-r0 | 2.7.15-r0 |
| alpine/python2-tkinter(Alpine:v3.9) | < 2.7.15-r0 | 2.7.15-r0 |
| alpine/python3(Alpine:v3.5) | < 3.5.6-r0 | 3.5.6-r0 |
| alpine/python3(Alpine:v3.6) | < 3.6.5-r0 | 3.6.5-r0 |
| alpine/python3(Alpine:v3.7) | < 3.6.5-r0 | 3.6.5-r0 |
| alpine/python3(Alpine:v3.8) | < 3.6.6-r0 | 3.6.6-r0 |
| [UNKNOWN] python | = python 2.7.15 | No fix listed |
| [UNKNOWN] python | = python 3.4.9 | No fix listed |
| [UNKNOWN] python | = python 3.5.6 | No fix listed |
| [UNKNOWN] python | = python 3.7.0 | No fix listed |
| python | >= 2.7.0, < 2.7.15 | 2.7.15 |
| python | >= 3.0.0, < 3.4.9 | 3.4.9 |
| python | >= 3.5.0, < 3.5.6 | 3.5.6 |
Show 14 more
| Product | Affected versions | Fixed in |
|---|---|---|
| python | >= 3.6.0, < 3.6.5 | 3.6.5 |
| fedoraproject fedora | = 28 | No fix listed |
| fedoraproject fedora | = 29 | No fix listed |
| fedoraproject fedora | = 30 | No fix listed |
| Canonical Ubuntu Linux | = 12.04 | No fix listed |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
| Canonical Ubuntu Linux | = 16.04 | No fix listed |
| Canonical Ubuntu Linux | = 18.04 | No fix listed |
| redhat ansible tower | = 3.3 | No fix listed |
| redhat enterprise linux desktop | = 7.0 | No fix listed |
| redhat enterprise linux server | = 7.0 | No fix listed |
| redhat enterprise linux workstation | = 7.0 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| debian linux | = 9.0 | No fix listed |
References
- security-tracker.debian.org vendor-advisory
- security.alpinelinux.org vendor-advisory
- DSA-4306 third-party-advisory vendor-advisory
- 1042001 third-party-advisory vdb-entry
- [debian-lts-announce] 20180926 [SECURITY] [DLA 1520-1] python3.4 security update mailing-list third-party-advisory
- bugs.python.org exploit issue-tracking vendor-advisory
- USN-3817-2 third-party-advisory vendor-advisory
- docs.python.org product vendor-advisory
- docs.python.org product vendor-advisory
- RHSA-2018:3505 third-party-advisory vendor-advisory
- bugzilla.redhat.com issue-tracking third-party-advisory
- RHSA-2018:3041 third-party-advisory vendor-advisory
- DSA-4307 third-party-advisory vendor-advisory
- USN-3817-1 third-party-advisory vendor-advisory
- [debian-lts-announce] 20180925 [SECURITY] [DLA 1519-1] python2.7 security update mailing-list third-party-advisory
- FEDORA-2019-6e1938a3c5 vendor-advisory
- FEDORA-2019-cf725dd20b vendor-advisory
- FEDORA-2019-51f1e08207 vendor-advisory
- RHBA-2019:0327 third-party-advisory vendor-advisory
- RHSA-2019:1260 third-party-advisory vendor-advisory
- support.hpe.com third-party-advisory
- RHSA-2019:3725 third-party-advisory vendor-advisory
- www.oracle.com third-party-advisory
- openSUSE-SU-2020:0086 mailing-list third-party-advisory vendor-advisory