PRIOn knowledge basePRION:CVE-2018-14647Code injection
Python’s elementtree C accelerator failed to initialise Expat’s hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat’s internal data structures, consuming large amounts CPU and RAM. The vulnerability exists in Python versions 3.7.0, 3.6.0 through 3.6.6, 3.5.0 through 3.5.6, 3.4.0 through 3.4.9, 2.7.0 through 2.7.15.
| CPE | Name | Operator | Version |
|---|---|---|---|
| ubuntu_linux | eq | 16.04 | |
| ubuntu_linux | eq | 12.04 | |
| ubuntu_linux | eq | 18.04 | |
| ubuntu_linux | eq | 14.04 | |
| debian_linux | eq | 8.0 | |
| debian_linux | eq | 9.0 | |
| fedora | eq | 30 | |
| leap | eq | 15.1 | |
| python | ge | 3.5.0 | |
| python | le | 3.5.6 |
References
lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html
www.securityfocus.com/bid/105396
www.securitytracker.com/id/1041740
access.redhat.com/errata/RHSA-2019:1260
access.redhat.com/errata/RHSA-2019:2030
access.redhat.com/errata/RHSA-2019:3725
bugs.python.org/issue34623
bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14647
lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3E
lists.debian.org/debian-lts-announce/2019/06/msg00022.html
lists.debian.org/debian-lts-announce/2019/06/msg00023.html
lists.fedoraproject.org/archives/list/[email protected]/message/RBJCB2HWOJLP3L7CUQHJHNBHLSVOXJE5/
usn.ubuntu.com/3817-1/
usn.ubuntu.com/3817-2/
www.debian.org/security/2018/dsa-4306
www.debian.org/security/2018/dsa-4307
Related
