CVE-2018-1060

Description

python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib's apop() method. An attacker could use this flaw to cause denial of service.

Scores

Faiblesses (CWE)

• CWE-20

Références européennes

• ENISA EUVD · EUVD-2018-11713
• GCVE · GCVE-0-2018-1060

Avis du CERT-FR

• CERTFR-2026-AVI-1385 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
• CERTFR-2022-AVI-267 — Multiples vulnérabilités dans Juniper Networks Junos Space · cert.ssi.gouv.fr
• CERTFR-2019-AVI-325 — Multiples vulnérabilités dans les produits Juniper · cert.ssi.gouv.fr

Configurations affectées (CPE NVD)

• cpe:2.3:a:python:python:*:*:*:*:*:*:*:* ≥ 2.7.0 < 2.7.15
• cpe:2.3:a:python:python:*:*:*:*:*:*:*:* ≥ 3.0.0 < 3.4.9
• cpe:2.3:a:python:python:*:*:*:*:*:*:*:* ≥ 3.5.0 < 3.5.6
• cpe:2.3:a:python:python:*:*:*:*:*:*:*:* > 3.6.0 < 3.6.5
• cpe:2.3:o:fedoraproject:fedora:28:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*
• cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*
• cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
• cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
• cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
• cpe:2.3:a:redhat:ansible_tower:3.3:*:*:*:*:*:*:*
• cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
• cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
• cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
• cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
• cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

Produits affectés

Références

• https://www.debian.org/security/2018/dsa-4306
• http://www.securitytracker.com/id/1042001
• https://lists.debian.org/debian-lts-announce/2018/09/msg00031.html
• https://bugs.python.org/issue32981
• https://usn.ubuntu.com/3817-2/
• https://docs.python.org/3.6/whatsnew/changelog.html#python-3-6-5-release-candidate-1
• https://docs.python.org/3.5/whatsnew/changelog.html#python-3-5-6-release-candidate-1
• https://access.redhat.com/errata/RHSA-2018:3505
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1060
• https://access.redhat.com/errata/RHSA-2018:3041
• https://www.debian.org/security/2018/dsa-4307
• https://usn.ubuntu.com/3817-1/
• https://lists.debian.org/debian-lts-announce/2018/09/msg00030.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JSKPGPZQNTAULHW4UH63KGOOUIDE4RRB/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AEZ5IQT7OF7Q2NCGIVABOWYGKO7YU3NJ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46PVWY5LFP4BRPG3BVQ5QEEFYBVEXHCK/
• https://access.redhat.com/errata/RHBA-2019:0327
• https://access.redhat.com/errata/RHSA-2019:1260
• https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03951en_us
• https://access.redhat.com/errata/RHSA-2019:3725
• https://www.oracle.com/security-alerts/cpujan2020.html
• http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html

Sources