CVEvulnerability
CVE-2018-1060
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2018-06-18
- Last modified
- 2026-10-08
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS 3.0 ([email protected])
- 4.3 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:N/A:P
- Weaknesses
- CWE-20
Description
python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib's apop() method. An attacker could use this flaw to cause denial of service.
Affected configurations
• python python (>= 2.7.0 < 2.7.15)
• python python (>= 3.0.0 < 3.4.9)
• python python (>= 3.5.0 < 3.5.6)
• python python (> 3.6.0 < 3.6.5)
• fedoraproject fedora 28
• fedoraproject fedora 29
• fedoraproject fedora 30
• canonical ubuntu linux 12.04
• canonical ubuntu linux 14.04
• canonical ubuntu linux 16.04
• canonical ubuntu linux 18.04
• redhat ansible tower 3.3
• redhat enterprise linux desktop 7.0
• redhat enterprise linux server 7.0
• redhat enterprise linux workstation 7.0
• debian debian linux 8.0
• debian debian linux 9.0
Related
Weakness · CWE (1)
- CWE-20 Improper Input Validation weakness
References
- http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html Mailing List, Third Party Advisory
- http://www.securitytracker.com/id/1042001 Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHBA-2019:0327 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:3041 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:3505 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:1260 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:3725 Third Party Advisory
- https://bugs.python.org/issue32981 Exploit, Issue Tracking, Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1060 Issue Tracking, Third Party Advisory
- https://docs.python.org/3.5/whatsnew/changelog.html#python-3-5-6-release-candidate-1 Product, Vendor Advisory
- https://docs.python.org/3.6/whatsnew/changelog.html#python-3-6-5-release-candidate-1 Product, Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2018/09/msg00030.html Mailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2018/09/msg00031.html Mailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46PVWY5LFP4BRPG3BVQ5QEEFYBVEXHCK/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AEZ5IQT7OF7Q2NCGIVABOWYGKO7YU3NJ/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JSKPGPZQNTAULHW4UH63KGOOUIDE4RRB/ lists.fedoraproject.org
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03951en_us Third Party Advisory
- https://usn.ubuntu.com/3817-1/ Third Party Advisory
- https://usn.ubuntu.com/3817-2/ Third Party Advisory
- https://www.debian.org/security/2018/dsa-4306 Third Party Advisory
- https://www.debian.org/security/2018/dsa-4307 Third Party Advisory
- https://www.oracle.com/security-alerts/cpujan2020.html Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html Mailing List, Third Party Advisory
- http://www.securitytracker.com/id/1042001 Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHBA-2019:0327 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:3041 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:3505 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:1260 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:3725 Third Party Advisory
- https://bugs.python.org/issue32981 Exploit, Issue Tracking, Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1060 Issue Tracking, Third Party Advisory
- https://docs.python.org/3.5/whatsnew/changelog.html#python-3-5-6-release-candidate-1 Product, Vendor Advisory
- https://docs.python.org/3.6/whatsnew/changelog.html#python-3-6-5-release-candidate-1 Product, Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2018/09/msg00030.html Mailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2018/09/msg00031.html Mailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46PVWY5LFP4BRPG3BVQ5QEEFYBVEXHCK/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AEZ5IQT7OF7Q2NCGIVABOWYGKO7YU3NJ/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JSKPGPZQNTAULHW4UH63KGOOUIDE4RRB/ lists.fedoraproject.org
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03951en_us Third Party Advisory
- https://usn.ubuntu.com/3817-1/ Third Party Advisory
- https://usn.ubuntu.com/3817-2/ Third Party Advisory
- https://www.debian.org/security/2018/dsa-4306 Third Party Advisory
- https://www.debian.org/security/2018/dsa-4307 Third Party Advisory
- https://www.oracle.com/security-alerts/cpujan2020.html Third Party Advisory