Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
nvd[email protected]NVD:CVE-2018-14647
HistorySep 25, 2018 - 12:29 a.m.

CVE-2018-14647

2018-09-2500:29:00
CWE-909
CWE-335
CWE-665
[email protected]
web.nvd.nist.gov
1

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

6.9 Medium

AI Score

Confidence

High

0.006 Low

EPSS

Percentile

79.2%

JSON

Python’s elementtree C accelerator failed to initialise Expat’s hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat’s internal data structures, consuming large amounts CPU and RAM. The vulnerability exists in Python versions 3.7.0, 3.6.0 through 3.6.6, 3.5.0 through 3.5.6, 3.4.0 through 3.4.9, 2.7.0 through 2.7.15.

Affected configurations

NVD
Node
pythonpythonRange2.7.0–2.7.15
OR
pythonpythonRange3.4.0–3.4.9
OR
pythonpythonRange3.5.0–3.5.6
OR
pythonpythonRange3.6.0–3.6.6
OR
pythonpythonMatch3.7.0
Node
canonicalubuntu_linuxMatch12.04esm
OR
canonicalubuntu_linuxMatch14.04esm
OR
canonicalubuntu_linuxMatch16.04lts
OR
canonicalubuntu_linuxMatch18.04lts
Node
debiandebian_linuxMatch8.0
OR
debiandebian_linuxMatch9.0
Node
fedoraprojectfedoraMatch30
Node
opensuseleapMatch15.1
Node
redhatenterprise_linux_desktopMatch7.0
OR
redhatenterprise_linux_serverMatch7.0
OR
redhatenterprise_linux_workstationMatch7.0

References

Related

openvas 52
fedora 28
prion 1
nessus 60
osv 6
amazon 3
ibm 10
redhatcve 1
alpinelinux 1
hackerone 1
veracode 1
cve 1
debiancve 1
ubuntucve 1
cvelist 1
suse 2
slackware 1
photon 7
mageia 2
debian 4
redhat 6
cloudfoundry 1
ubuntu 2
centos 1
oraclelinux 1
openvas
openvas
Fedora Update for python35 FEDORA-2018-7689556ab2
2018-10-26 00:00:00
Fedora Update for python35 FEDORA-2018-ac14dbf3fd
2019-05-07 00:00:00
Python 2.7.x < 2.7.16, 3.4.x < 3.4.10, 3.5.x < 3.5.7, 3.6.x < 3.6.7, 3.7.0 Python Issue (bpo-34623) - Linux
2021-10-04 00:00:00
fedora
fedora
[SECURITY] Fedora 28 Update: python33-3.3.7-6.fc28
2018-11-13 02:28:08
[SECURITY] Fedora 28 Update: python3-3.6.7-2.fc28
2018-11-29 02:28:14
[SECURITY] Fedora 29 Update: python36-3.6.8-1.fc29
2019-01-18 02:14:44
prion
prion
Code injection
2018-09-25 00:29:00
nessus
nessus
SUSE SLES11 Security Update : python (SUSE-SU-2018:3156-1)
2018-10-17 00:00:00
Fedora 27 : python2 (2018-b6de5fc905)
2018-10-22 00:00:00
Fedora 29 : python35 (2018-ac14dbf3fd)
2019-01-03 00:00:00
osv
osv
CVE-2018-14647
2018-09-25 00:29:00
_elementree C accelerator doesn't call XML_SetHashSalt()
2018-09-25 00:00:00
python3.4 - security update
2019-06-24 00:00:00
amazon
amazon
Medium: python35
2018-11-05 21:47:00
Medium: python34, python36
2018-12-20 00:01:00
Medium: python3
2018-12-17 19:14:00
ibm
ibm
Security Bulletin: Vulnerability in Python affects IBM Analytics Engine (CVE-2018-14647)
2019-06-03 21:25:01
Security Bulletin: IBM BladeCenter Advanced Management Module (AMM) is affected by vulnerability in python (CVE-2018-14647)
2019-04-11 22:55:01
Security Bulletin: A Security Vulnerability affects IBM Cloud Private - Python
2019-03-12 22:45:01
redhatcve
redhatcve
CVE-2018-14647
2020-04-02 08:14:30
alpinelinux
alpinelinux
CVE-2018-14647
2018-09-25 00:29:00
hackerone
hackerone
Internet Bug Bounty: XML hash collision DoS vulnerability in Python's xml.etree module
2018-09-22 06:36:27
veracode
veracode
Denial Of Service (DoS)
2019-05-27 00:40:17
cve
cve
CVE-2018-14647
2018-09-25 00:29:00
debiancve
debiancve
CVE-2018-14647
2018-09-25 00:29:00
ubuntucve
ubuntucve
CVE-2018-14647
2018-09-24 00:00:00
cvelist
cvelist
CVE-2018-14647
2018-09-25 00:00:00
suse
suse
Security update for python (important)
2019-03-06 00:00:00
Security update for python3 (important)
2020-01-21 00:00:00
slackware
slackware
[slackware-security] python
2019-03-03 22:46:15
photon
photon
Important Photon OS Security Update - PHSA-2019-0120
2019-01-10 00:00:00
Home Download Photon OS User Documentation FAQ Security Advisories Related Information Lightwave - PHSA-2019-2.0-0120
2019-01-10 00:00:00
Home Download Photon OS User Documentation FAQ Security Advisories Related Information Lightwave - PHSA-2019-2.0-0118
2019-01-07 00:00:00
mageia
mageia
Updated python packages fix security vulnerabilities
2019-01-01 01:42:09
Updated python3 packages fix security vulnerability
2019-04-11 00:25:19
debian
debian
[SECURITY] [DLA 1835-1] python3.4 security update
2019-06-25 03:40:34
[SECURITY] [DSA 4307-1] python3.5 security update
2018-09-28 19:17:56
[SECURITY] [DSA 4306-1] python2.7 security update
2018-09-27 21:05:32
redhat
redhat
(RHSA-2020:1462) Moderate: python security update
2020-04-14 14:34:05
(RHSA-2019:2030) Moderate: python security and bug fix update
2019-08-06 07:52:47
(RHSA-2020:1346) Moderate: python security update
2020-04-07 08:31:07
cloudfoundry
cloudfoundry
USN-3817-1: Python vulnerabilities | Cloud Foundry
2018-11-20 00:00:00
ubuntu
ubuntu
Python vulnerabilities
2018-11-15 00:00:00
Python vulnerabilities
2018-11-13 00:00:00
centos
centos
python, tkinter security update
2019-08-30 04:00:52
oraclelinux
oraclelinux
python security and bug fix update
2019-08-13 00:00:00

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

6.9 Medium

AI Score

Confidence

High

0.006 Low

EPSS

Percentile

79.2%

JSON
Related for NVD:CVE-2018-14647
openvas52fedora28prion1nessus60osv6amazon3ibm10redhatcve1alpinelinux1hackerone1veracode1cve1debiancve1ubuntucve1cvelist1suse2slackware1photon7mageia2debian4redhat6cloudfoundry1ubuntu2centos1oraclelinux1