High severity · published Jun 18, 2018
CVE-2018-1060
python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib's apop() method
7.5
CVSS
5%
EPSS
No
On KEV
Description
python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib's apop() method. An attacker could use this flaw to cause denial of service.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)5.0% · higher than 92% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PY
python · [UNKNOWN]
python 2.7.15; python 3.4.9; python 3.5.6; python 3.7.0 · source: vendor, NVD
AT
Ansible Tower · Redhat
3.3 · source: NVD
DL
Debian Linux · Debian
8.0; 9.0 · source: NVD
EL
Enterprise Linux Desktop · Redhat
7.0 · source: NVD
EL
Enterprise Linux Server · Redhat
7.0 · source: NVD
EL
Enterprise Linux Workstation · Redhat
7.0 · source: NVD
FE
Fedora · Fedoraproject
28; 29; 30 · source: NVD
UL
Ubuntu Linux · Canonical
12.04; 14.04; 16.04; 18.04 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-1060
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-1060
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html
Third Party Advisory
http://www.securitytracker.com/id/1042001
Third Party Advisory
https://access.redhat.com/errata/RHBA-2019:0327
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:3041
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:3505
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1260
More from python
7.5
CVE-2018-1061
python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in the difflib.IS_LINE_JUNK method