CVE-2018-1060

· HIGHModified

← All CVEs

CVSS v3.1

7.5

EPSS

5.29%

Published

Jun 18, 2018

Modified

Nov 21, 2024

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib's apop() method. An attacker could use this flaw to cause denial of service.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

CWE-20

Affected Products (17)

python · python (up to 2.7.15)vulnerable

python · python (up to 3.4.9)vulnerable

python · python (up to 3.5.6)vulnerable

python · python (up to 3.6.5)vulnerable

fedoraproject · fedoravulnerable

canonical · ubuntu_linuxvulnerable

redhat · ansible_towervulnerable

redhat · enterprise_linux_desktopvulnerable

redhat · enterprise_linux_servervulnerable

redhat · enterprise_linux_workstationvulnerable

debian · debian_linuxvulnerable

References (20)

http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html

Mailing ListThird Party Advisory

http://www.securitytracker.com/id/1042001

Third Party AdvisoryVDB Entry

https://access.redhat.com/errata/RHBA-2019:0327

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:3041

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:3505

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:1260

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:3725

Third Party Advisory

https://bugs.python.org/issue32981

ExploitIssue TrackingVendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1060

Issue TrackingThird Party Advisory

https://docs.python.org/3.5/whatsnew/changelog.html#python-3-5-6-release-candidate-1

ProductVendor Advisory

https://docs.python.org/3.6/whatsnew/changelog.html#python-3-6-5-release-candidate-1

ProductVendor Advisory

https://lists.debian.org/debian-lts-announce/2018/09/msg00030.html

Mailing ListThird Party Advisory

https://lists.debian.org/debian-lts-announce/2018/09/msg00031.html

Mailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46PVWY5LFP4BRPG3BVQ5QEEFYBVEXHCK/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AEZ5IQT7OF7Q2NCGIVABOWYGKO7YU3NJ/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JSKPGPZQNTAULHW4UH63KGOOUIDE4RRB/

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03951en_us

Third Party Advisory

https://usn.ubuntu.com/3817-1/

Third Party Advisory

https://usn.ubuntu.com/3817-2/

Third Party Advisory

https://www.debian.org/security/2018/dsa-4306

Third Party Advisory

KEV Catalog EPSS Scores Vendors All CVEs