CVEvulnerability

CVE-2018-14647

7.5 HIGH Published 2018-09-25 Modified 2026-10-07 Official page ↗
Status
Modified
Published
2018-09-25
Last modified
2026-10-07
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 3.0 ([email protected])
5.3 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:N/A:P
Weaknesses
CWE-335, CWE-665, CWE-909

Description

Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming large amounts CPU and RAM. The vulnerability exists in Python versions 3.7.0, 3.6.0 through 3.6.6, 3.5.0 through 3.5.6, 3.4.0 through 3.4.9, 2.7.0 through 2.7.15.

Affected configurations

• python python (>= 2.7.0 <= 2.7.15) • python python (>= 3.4.0 <= 3.4.9) • python python (>= 3.5.0 <= 3.5.6) • python python (>= 3.6.0 <= 3.6.6) • python python 3.7.0 • canonical ubuntu linux 12.04 • canonical ubuntu linux 14.04 • canonical ubuntu linux 16.04 • canonical ubuntu linux 18.04 • debian debian linux 8.0 • debian debian linux 9.0 • fedoraproject fedora 30 • opensuse leap 15.1 • redhat enterprise linux desktop 7.0 • redhat enterprise linux server 7.0 • redhat enterprise linux workstation 7.0

Related

Weakness · CWE (3)

  • CWE-335 Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) weakness
  • CWE-665 Improper Initialization weakness
  • CWE-909 Missing Initialization of Resource weakness

References