CVE-2018-1060

Опубликовано: 18 июн. 2018

Источник: nvd

CVSS3: 4.3

CVSS3: 7.5

CVSS2: 5

EPSS Низкий

Описание

python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib's apop() method. An attacker could use this flaw to cause denial of service.

Ссылки

http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html
Mailing List
Third Party Advisory
http://www.securitytracker.com/id/1042001
Third Party Advisory
VDB Entry
https://access.redhat.com/errata/RHBA-2019:0327
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:3041
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:3505
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1260
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3725
Third Party Advisory
https://bugs.python.org/issue32981
Exploit
Issue Tracking
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1060
Issue Tracking
Third Party Advisory
https://docs.python.org/3.5/whatsnew/changelog.html#python-3-5-6-release-candidate-1
Product
Vendor Advisory
https://docs.python.org/3.6/whatsnew/changelog.html#python-3-6-5-release-candidate-1
Product
Vendor Advisory
https://lists.debian.org/debian-lts-announce/2018/09/msg00030.html
Mailing List
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/09/msg00031.html
Mailing List
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46PVWY5LFP4BRPG3BVQ5QEEFYBVEXHCK/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AEZ5IQT7OF7Q2NCGIVABOWYGKO7YU3NJ/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JSKPGPZQNTAULHW4UH63KGOOUIDE4RRB/
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03951en_us
Third Party Advisory
https://usn.ubuntu.com/3817-1/
Third Party Advisory
https://usn.ubuntu.com/3817-2/
Third Party Advisory
https://www.debian.org/security/2018/dsa-4306
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:python:python:*:*:*:*:*:*:*:*

Версия от 2.7.0 (включая) до 2.7.15 (исключая)

cpe:2.3:a:python:python:*:*:*:*:*:*:*:*

Версия от 3.0.0 (включая) до 3.4.9 (исключая)

cpe:2.3:a:python:python:*:*:*:*:*:*:*:*

Версия от 3.5.0 (включая) до 3.5.6 (исключая)

cpe:2.3:a:python:python:*:*:*:*:*:*:*:*

Версия от 3.6.0 (исключая) до 3.6.5 (исключая)

Конфигурация 2

Одно из

cpe:2.3:o:fedoraproject:fedora:28:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*

Конфигурация 4

Одно из

cpe:2.3:a:redhat:ansible_tower:3.3:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*

Конфигурация 5

Одно из

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

EPSS

Процентиль: 74%

0.00855

Низкий

4.3 Medium

CVSS3

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-20

NVD-CWE-noinfo

Связанные уязвимости

CVE-2018-1060

CVSS3: 7.5

ubuntu

около 7 лет назад

python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib's apop() method. An attacker could use this flaw to cause denial of service.

CVE-2018-1060

CVSS3: 4.3

redhat

больше 7 лет назад

python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib's apop() method. An attacker could use this flaw to cause denial of service.

CVE-2018-1060

CVSS3: 7.5

debian

около 7 лет назад

python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is ...

GHSA-7hp6-577h-hcgr

CVSS3: 7.5

github

около 3 лет назад

python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib's apop() method. An attacker could use this flaw to cause denial of service.

BDU:2019-04237

CVSS3: 7.5

fstec

почти 7 лет назад

Уязвимость метода pop3lib apop() интерпретатора языка программирования Python, позволяющая нарушителю вызвать отказ в обслуживании

EPSS

Процентиль: 74%

0.00855

Низкий

4.3 Medium

CVSS3

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-20

NVD-CWE-noinfo