CVE-2018-14647
High
Description
Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming large amounts CPU and RAM. The vulnerability exists in Python versions 3.7.0, 3.6.0 through 3.6.6, 3.5.0 through 3.5.6, 3.4.0 through 3.4.9, 2.7.0 through 2.7.15.
SeverityHigh
CVSS7.5
Exploit probability96. percentile10.9%
Product
Python
PublishedSep 25, 2018
First seenSep 25, 2018
Weakness typeCWE-665CWE-665CWE-335CWE-335
How to fix
Vendor advisories
- debian.org/security/2018/dsa-4306
- usn.ubuntu.com/3817-2/
- debian.org/security/2018/dsa-4307
- usn.ubuntu.com/3817-1/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RBJCB2HWOJLP3L7CUQHJHNBHLSVOXJE5/
- access.redhat.com/errata/RHSA-2019:1260
- access.redhat.com/errata/RHSA-2019:2030
- access.redhat.com/errata/RHSA-2019:3725
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| python python | 2.7.0 ≤ v ≤ 2.7.15, 3.4.0 ≤ v ≤ 3.4.9, 3.5.0 ≤ v ≤ 3.5.6, 3.6.0 ≤ v ≤ 3.6.6, 3.7.0 | — |
| canonical ubuntu_linux | 12.04, 14.04, 16.04, 18.04 | — |
| debian debian_linux | 8.0, 9.0 | — |
| fedoraproject fedora | 30 | — |
| opensuse leap | 15.1 | — |
| redhat enterprise_linux_desktop | 7.0 | — |
| redhat enterprise_linux_server | 7.0 | — |
| redhat enterprise_linux_workstation | 7.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.