CVE search · CVE-2018-14647
CVE-2018-14647
high 7.5
Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming large amounts CPU and RAM. The vulnerability exists in Python versions 3.7.0, 3.6.0 through 3.6.6, 3.5.0 through 3.5.6, 3.4.0 through 3.4.9, 2.7.0 through 2.7.15.
Details
- Status
- Modified
- Published
- Last changed
- Source
- secalert@redhat.com
Severity
| Version | Score | Vector | Source |
|---|---|---|---|
| CVSS 3.1 | high 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
nvd@nist.govPrimary |
| CVSS 3.0 | medium 5.3 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
secalert@redhat.comSecondary |
| CVSS 2.0 | medium 5.0 | AV:N/AC:L/Au:N/C:N/I:N/A:P |
nvd@nist.govPrimary |
Affected products
Vendor and product from the NVD’s CPE applicability statements. Versions and conditions are on the NVD’s page.
- python · python
- canonical · ubuntu_linux
- debian · debian_linux
- fedoraproject · fedora
- opensuse · leap
- redhat · enterprise_linux_desktop
- redhat · enterprise_linux_server
- redhat · enterprise_linux_workstation
References
- http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.htmlMailing ListThird Party Advisory
- http://www.securityfocus.com/bid/105396Third Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1041740Third Party AdvisoryVDB Entry
- https://access.redhat.com/errata/RHSA-2019:1260Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2030Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:3725Third Party Advisory
- https://bugs.python.org/issue34623Issue TrackingPatchVendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14647Issue TrackingThird Party Advisory
- https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2019/06/msg00022.htmlMailing ListThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/06/msg00023.htmlMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RBJCB2HWOJLP3L7CUQHJHNBHLSVOXJE5/
- https://usn.ubuntu.com/3817-1/Third Party Advisory
- https://usn.ubuntu.com/3817-2/Third Party Advisory
- https://www.debian.org/security/2018/dsa-4306Third Party Advisory
- https://www.debian.org/security/2018/dsa-4307Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.htmlMailing ListThird Party Advisory
- http://www.securityfocus.com/bid/105396Third Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1041740Third Party AdvisoryVDB Entry
- https://access.redhat.com/errata/RHSA-2019:1260Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2030Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:3725Third Party Advisory
- https://bugs.python.org/issue34623Issue TrackingPatchVendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14647Issue TrackingThird Party Advisory
- https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2019/06/msg00022.htmlMailing ListThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/06/msg00023.htmlMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RBJCB2HWOJLP3L7CUQHJHNBHLSVOXJE5/
- https://usn.ubuntu.com/3817-1/Third Party Advisory
- https://usn.ubuntu.com/3817-2/Third Party Advisory
- https://www.debian.org/security/2018/dsa-4306Third Party Advisory
- https://www.debian.org/security/2018/dsa-4307Third Party Advisory