Lucene search

[email protected]CVE-2018-14647

HistorySep 25, 2018 - 12:29 a.m.

CVE-2018-14647

2018-09-2500:29:00

CWE-909

[email protected]

web.nvd.nist.gov

471

cve

2018

14647

python

elementtree

c accelerator

expat

hash salt

denial of service

xml

hash collisions

cpu

ram

vulnerability

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.9 High

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.004 Low

EPSS

Percentile

74.6%

JSON

Python’s elementtree C accelerator failed to initialise Expat’s hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat’s internal data structures, consuming large amounts CPU and RAM. The vulnerability exists in Python versions 3.7.0, 3.6.0 through 3.6.6, 3.5.0 through 3.5.6, 3.4.0 through 3.4.9, 2.7.0 through 2.7.15.

VendorProductVersionCPE
pythonjython*cpe:2.3:a:python:jython:*:*:*:*:*:*:*:*
pythonjython*cpe:2.3:a:python:jython:*:*:*:*:*:*:*:*
pythonjython*cpe:2.3:a:python:jython:*:*:*:*:*:*:*:*
pythonjython*cpe:2.3:a:python:jython:*:*:*:*:*:*:*:*
pythonjython*cpe:2.3:a:python:jython:*:*:*:*:*:*:*:*
pythonjython*cpe:2.3:a:python:jython:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
python	jython	*	cpe:2.3:a:python:jython::::::::
python	jython	*	cpe:2.3:a:python:jython::::::::
python	jython	*	cpe:2.3:a:python:jython::::::::
python	jython	*	cpe:2.3:a:python:jython::::::::
python	jython	*	cpe:2.3:a:python:jython::::::::
python	jython	*	cpe:2.3:a:python:jython::::::::