RedhatCVELIST:CVE-2018-1060CVE-2018-1060
4.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
LOW
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
8.3 High
AI Score
Confidence
High
0.004 Low
EPSS
Percentile
74.0%
python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib’s apop() method. An attacker could use this flaw to cause denial of service.
CNA Affected
[
{
"product": "python",
"vendor": "[UNKNOWN]",
"versions": [
{
"status": "affected",
"version": "python 2.7.15"
},
{
"status": "affected",
"version": "python 3.4.9"
},
{
"status": "affected",
"version": "python 3.5.6"
},
{
"status": "affected",
"version": "python 3.7.0"
}
]
}
]References
lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html
www.securitytracker.com/id/1042001
access.redhat.com/errata/RHBA-2019:0327
access.redhat.com/errata/RHSA-2018:3041
access.redhat.com/errata/RHSA-2018:3505
access.redhat.com/errata/RHSA-2019:1260
access.redhat.com/errata/RHSA-2019:3725
bugs.python.org/issue32981
bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1060
docs.python.org/3.5/whatsnew/changelog.html#python-3-5-6-release-candidate-1
docs.python.org/3.6/whatsnew/changelog.html#python-3-6-5-release-candidate-1
lists.debian.org/debian-lts-announce/2018/09/msg00030.html
lists.debian.org/debian-lts-announce/2018/09/msg00031.html
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46PVWY5LFP4BRPG3BVQ5QEEFYBVEXHCK/
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AEZ5IQT7OF7Q2NCGIVABOWYGKO7YU3NJ/
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JSKPGPZQNTAULHW4UH63KGOOUIDE4RRB/
support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03951en_us
usn.ubuntu.com/3817-1/
usn.ubuntu.com/3817-2/
www.debian.org/security/2018/dsa-4306
www.debian.org/security/2018/dsa-4307
www.oracle.com/security-alerts/cpujan2020.html
Related
4.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
LOW
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
8.3 High
AI Score
Confidence
High
0.004 Low
EPSS
Percentile
74.0%