Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
nvd[email protected]NVD:CVE-2018-14647
HistorySep 25, 2018 - 12:29 a.m.

CVE-2018-14647

2018-09-2500:29:00
CWE-665
CWE-909
CWE-335
[email protected]
web.nvd.nist.gov
8

CVSS2

5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

6.9

Confidence

High

EPSS

0.009

Percentile

82.8%

JSON

Python’s elementtree C accelerator failed to initialise Expat’s hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat’s internal data structures, consuming large amounts CPU and RAM. The vulnerability exists in Python versions 3.7.0, 3.6.0 through 3.6.6, 3.5.0 through 3.5.6, 3.4.0 through 3.4.9, 2.7.0 through 2.7.15.

Affected configurations

Nvd
Node
pythonpythonRange2.7.0–2.7.15
OR
pythonpythonRange3.4.0–3.4.9
OR
pythonpythonRange3.5.0–3.5.6
OR
pythonpythonRange3.6.0–3.6.6
OR
pythonpythonMatch3.7.0
Node
canonicalubuntu_linuxMatch12.04esm
OR
canonicalubuntu_linuxMatch14.04esm
OR
canonicalubuntu_linuxMatch16.04lts
OR
canonicalubuntu_linuxMatch18.04lts
Node
debiandebian_linuxMatch8.0
OR
debiandebian_linuxMatch9.0
Node
fedoraprojectfedoraMatch30
Node
opensuseleapMatch15.1
Node
redhatenterprise_linux_desktopMatch7.0
OR
redhatenterprise_linux_serverMatch7.0
OR
redhatenterprise_linux_workstationMatch7.0

References

Related

fedora 28
prion 1
openvas 53
nessus 62
amazon 3
osv 7
redhatcve 1
ibm 9
alpinelinux 1
cvelist 1
ubuntucve 1
veracode 1
debiancve 1
hackerone 1
cve 1
suse 2
photon 7
slackware 1
mageia 2
debian 4
redhat 6
cloudfoundry 1
ubuntu 3
centos 1
oraclelinux 1
fedora
fedora
[SECURITY] Fedora 28 Update: python33-3.3.7-6.fc28
2018-11-13 02:28:08
[SECURITY] Fedora 29 Update: python36-3.6.8-1.fc29
2019-01-18 02:14:44
[SECURITY] Fedora 28 Update: python3-3.6.7-2.fc28
2018-11-29 02:28:14
prion
prion
Code injection
2018-09-25 00:29:00
openvas
openvas
Fedora Update for python3 FEDORA-2018-9860917db0
2019-05-07 00:00:00
Fedora Update for python35 FEDORA-2018-ac14dbf3fd
2019-05-07 00:00:00
Fedora Update for python35 FEDORA-2018-7689556ab2
2018-10-26 00:00:00
nessus
nessus
Fedora 27 : python2 (2018-b6de5fc905)
2018-10-22 00:00:00
Fedora 29 : python35 (2018-ac14dbf3fd)
2019-01-03 00:00:00
SUSE SLES11 Security Update : python (SUSE-SU-2018:3156-1)
2018-10-17 00:00:00
amazon
amazon
Medium: python35
2018-11-05 21:47:00
Medium: python34, python36
2018-12-20 00:01:00
Medium: python3
2018-12-17 19:14:00
osv
osv
CVE-2018-14647
2018-09-25 00:29:00
_elementree C accelerator doesn't call XML_SetHashSalt()
2018-09-25 00:00:00
python3.4 - security update
2019-06-24 00:00:00
redhatcve
redhatcve
CVE-2018-14647
2020-04-02 08:14:30
ibm
ibm
Security Bulletin: Vulnerability in Python affects IBM Analytics Engine (CVE-2018-14647)
2019-06-03 21:25:01
Security Bulletin: A vulnerability in Python affects IBM Operations Analytics Predictive Insights (CVE-2018-14647)
2020-02-28 15:54:09
Security Bulletin: Vulnerability in Python affects Watson Studio (Notebook) (CVE-2018-14647)
2020-07-06 20:58:25
alpinelinux
alpinelinux
CVE-2018-14647
2018-09-25 00:29:00
cvelist
cvelist
CVE-2018-14647
2018-09-25 00:00:00
ubuntucve
ubuntucve
CVE-2018-14647
2018-09-24 00:00:00
veracode
veracode
Denial Of Service (DoS)
2019-05-27 00:40:17
debiancve
debiancve
CVE-2018-14647
2018-09-25 00:29:00
hackerone
hackerone
Internet Bug Bounty: XML hash collision DoS vulnerability in Python's xml.etree module
2018-09-22 06:36:27
cve
cve
CVE-2018-14647
2018-09-25 00:29:00
suse
suse
Security update for python (important)
2019-03-06 00:00:00
Security update for python3 (important)
2020-01-21 00:00:00
photon
photon
Important Photon OS Security Update - PHSA-2019-0120
2019-01-10 00:00:00
Home Download Photon OS User Documentation FAQ Security Advisories Related Information Lightwave - PHSA-2019-2.0-0120
2019-01-10 00:00:00
Home Download Photon OS User Documentation FAQ Security Advisories Related Information Lightwave - PHSA-2019-2.0-0118
2019-01-07 00:00:00
slackware
slackware
[slackware-security] python
2019-03-03 22:46:15
mageia
mageia
Updated python packages fix security vulnerabilities
2019-01-01 01:42:09
Updated python3 packages fix security vulnerability
2019-04-11 00:25:19
debian
debian
[SECURITY] [DLA 1835-1] python3.4 security update
2019-06-25 03:40:34
[SECURITY] [DSA 4306-1] python2.7 security update
2018-09-27 21:05:32
[SECURITY] [DSA 4307-1] python3.5 security update
2018-09-28 19:17:56
redhat
redhat
(RHSA-2020:1462) Moderate: python security update
2020-04-14 14:34:05
(RHSA-2019:2030) Moderate: python security and bug fix update
2019-08-06 07:52:47
(RHSA-2020:1346) Moderate: python security update
2020-04-07 08:31:07
cloudfoundry
cloudfoundry
USN-3817-1: Python vulnerabilities | Cloud Foundry
2018-11-20 00:00:00
ubuntu
ubuntu
Python vulnerabilities
2018-11-15 00:00:00
Python vulnerabilities
2018-11-13 00:00:00
Python vulnerabilities
2024-07-11 00:00:00
centos
centos
python, tkinter security update
2019-08-30 04:00:52
oraclelinux
oraclelinux
python security and bug fix update
2019-08-13 00:00:00

CVSS2

5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

6.9

Confidence

High

EPSS

0.009

Percentile

82.8%

JSON
Related for NVD:CVE-2018-14647
fedora28prion1openvas53nessus62amazon3osv7redhatcve1ibm9alpinelinux1cvelist1ubuntucve1veracode1debiancve1hackerone1cve1suse2photon7slackware1mageia2debian4redhat6cloudfoundry1ubuntu3centos1oraclelinux1