High severity · published Sep 25, 2018
CVE-2018-14647
Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization
7.5
CVSS
10.9%
EPSS
No
On KEV
Description
Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming large amounts CPU and RAM. The vulnerability exists in Python versions 3.7.0, 3.6.0 through 3.6.6, 3.5.0 through 3.5.6, 3.4.0 through 3.4.9, 2.7.0 through 2.7.15.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)10.9% · higher than 96% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PY
Python · The Python Project
3.8, 3.7, 3.6, 3.5, 3.4, 2.7 · source: vendor, NVD
DL
Debian Linux · Debian
8.0; 9.0 · source: NVD
EL
Enterprise Linux Desktop · Redhat
7.0 · source: NVD
EL
Enterprise Linux Server · Redhat
7.0 · source: NVD
EL
Enterprise Linux Workstation · Redhat
7.0 · source: NVD
FE
Fedora · Fedoraproject
30 · source: NVD
LE
Leap · Opensuse
15.1 · source: NVD
UL
Ubuntu Linux · Canonical
12.04; 14.04; 16.04; 18.04 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-14647
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-14647
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html
Third Party Advisory
http://www.securityfocus.com/bid/105396
Third Party Advisory
http://www.securitytracker.com/id/1041740
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1260
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2030
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3725