CVE-2018-1060CWE-20

CVE-2018-1060

High · published June 18, 2018

CVSS v3.1
7.5
EPSS
5%
Percentile
92.3
In the wild
Unconfirmed
What it is

python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib's apop() method. An attacker could use this flaw to cause denial of service.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.05039 · 92.3th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2018-06-18T18:29Z
Affected products (17)
ProductVersionsFixed in
python/python≥ 2.7.0, < 2.7.152.7.15
python/python≥ 3.0.0, < 3.4.93.4.9
python/python≥ 3.5.0, < 3.5.63.5.6
python/python> 3.6.0, < 3.6.53.6.5
fedoraproject/fedoraall versions—
fedoraproject/fedoraall versions—
fedoraproject/fedoraall versions—
canonical/ubuntu_linuxall versions—
canonical/ubuntu_linuxall versions—
canonical/ubuntu_linuxall versions—
canonical/ubuntu_linuxall versions—
redhat/ansible_towerall versions—
redhat/enterprise_linux_desktopall versions—
redhat/enterprise_linux_serverall versions—
redhat/enterprise_linux_workstationall versions—
debian/debian_linuxall versions—
debian/debian_linuxall versions—
References (44)
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html · [email protected]http://www.securitytracker.com/id/1042001 · [email protected]https://access.redhat.com/errata/RHBA-2019:0327 · [email protected]https://access.redhat.com/errata/RHSA-2018:3041 · [email protected]https://access.redhat.com/errata/RHSA-2018:3505 · [email protected]https://access.redhat.com/errata/RHSA-2019:1260 · [email protected]https://access.redhat.com/errata/RHSA-2019:3725 · [email protected]https://bugs.python.org/issue32981 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1060 · [email protected]https://docs.python.org/3.5/whatsnew/changelog.html#python-3-5-6-release-candidate-1 · [email protected]https://docs.python.org/3.6/whatsnew/changelog.html#python-3-6-5-release-candidate-1 · [email protected]https://lists.debian.org/debian-lts-announce/2018/09/msg00030.html · [email protected]https://lists.debian.org/debian-lts-announce/2018/09/msg00031.html · [email protected]https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46PVWY5LFP4BRPG3BVQ5QEEFYBVEXHCK/ · [email protected]https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AEZ5IQT7OF7Q2NCGIVABOWYGKO7YU3NJ/ · [email protected]https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JSKPGPZQNTAULHW4UH63KGOOUIDE4RRB/ · [email protected]https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03951en_us · [email protected]https://usn.ubuntu.com/3817-1/ · [email protected]https://usn.ubuntu.com/3817-2/ · [email protected]https://www.debian.org/security/2018/dsa-4306 · [email protected]https://www.debian.org/security/2018/dsa-4307 · [email protected]https://www.oracle.com/security-alerts/cpujan2020.html · [email protected]http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html · af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id/1042001 · af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHBA-2019:0327 · af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2018:3041 · af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2018:3505 · af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2019:1260 · af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2019:3725 · af854a3a-2127-422b-91ae-364da2661108https://bugs.python.org/issue32981 · af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1060 · af854a3a-2127-422b-91ae-364da2661108https://docs.python.org/3.5/whatsnew/changelog.html#python-3-5-6-release-candidate-1 · af854a3a-2127-422b-91ae-364da2661108https://docs.python.org/3.6/whatsnew/changelog.html#python-3-6-5-release-candidate-1 · af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2018/09/msg00030.html · af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2018/09/msg00031.html · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46PVWY5LFP4BRPG3BVQ5QEEFYBVEXHCK/ · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AEZ5IQT7OF7Q2NCGIVABOWYGKO7YU3NJ/ · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JSKPGPZQNTAULHW4UH63KGOOUIDE4RRB/ · af854a3a-2127-422b-91ae-364da2661108https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03951en_us · af854a3a-2127-422b-91ae-364da2661108https://usn.ubuntu.com/3817-1/ · af854a3a-2127-422b-91ae-364da2661108https://usn.ubuntu.com/3817-2/ · af854a3a-2127-422b-91ae-364da2661108https://www.debian.org/security/2018/dsa-4306 · af854a3a-2127-422b-91ae-364da2661108https://www.debian.org/security/2018/dsa-4307 · af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpujan2020.html · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 18 JUN 14:00Z
    python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib's apop() method
    cvelistv5