CVE-2018-1060

Description

python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib's apop() method. An attacker could use this flaw to cause denial of service.

Scores

Weaknesses (CWE)

• CWE-20

European references

• ENISA EUVD · EUVD-2018-11713
• GCVE · GCVE-0-2018-1060

CERT-FR advisories

• CERTFR-2026-AVI-1385 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
• CERTFR-2022-AVI-267 — Multiples vulnérabilités dans Juniper Networks Junos Space · cert.ssi.gouv.fr
• CERTFR-2019-AVI-325 — Multiples vulnérabilités dans les produits Juniper · cert.ssi.gouv.fr

Affected configurations (NVD CPE)

• cpe:2.3:a:python:python:*:*:*:*:*:*:*:* ≥ 2.7.0 < 2.7.15
• cpe:2.3:a:python:python:*:*:*:*:*:*:*:* ≥ 3.0.0 < 3.4.9
• cpe:2.3:a:python:python:*:*:*:*:*:*:*:* ≥ 3.5.0 < 3.5.6
• cpe:2.3:a:python:python:*:*:*:*:*:*:*:* > 3.6.0 < 3.6.5
• cpe:2.3:o:fedoraproject:fedora:28:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*
• cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*
• cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
• cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
• cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
• cpe:2.3:a:redhat:ansible_tower:3.3:*:*:*:*:*:*:*
• cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
• cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
• cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
• cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
• cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

Affected products

References

• https://www.debian.org/security/2018/dsa-4306
• http://www.securitytracker.com/id/1042001
• https://lists.debian.org/debian-lts-announce/2018/09/msg00031.html
• https://bugs.python.org/issue32981
• https://usn.ubuntu.com/3817-2/
• https://docs.python.org/3.6/whatsnew/changelog.html#python-3-6-5-release-candidate-1
• https://docs.python.org/3.5/whatsnew/changelog.html#python-3-5-6-release-candidate-1
• https://access.redhat.com/errata/RHSA-2018:3505
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1060
• https://access.redhat.com/errata/RHSA-2018:3041
• https://www.debian.org/security/2018/dsa-4307
• https://usn.ubuntu.com/3817-1/
• https://lists.debian.org/debian-lts-announce/2018/09/msg00030.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JSKPGPZQNTAULHW4UH63KGOOUIDE4RRB/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AEZ5IQT7OF7Q2NCGIVABOWYGKO7YU3NJ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46PVWY5LFP4BRPG3BVQ5QEEFYBVEXHCK/
• https://access.redhat.com/errata/RHBA-2019:0327
• https://access.redhat.com/errata/RHSA-2019:1260
• https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03951en_us
• https://access.redhat.com/errata/RHSA-2019:3725
• https://www.oracle.com/security-alerts/cpujan2020.html
• http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html

Sources