7.5

CVE-2018-1061

python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in the difflib.IS_LINE_JUNK method.  An attacker could use this flaw to cause denial of service.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Python ≫ Python Version < 2.7.15
Python ≫ Python Version >= 3.0 < 3.4.9
Python ≫ Python Version >= 3.5.0 <= 3.5.5
Python ≫ Python Version >= 3.6 <= 3.6.4
Python ≫ Python Version3.7.0 Updatealpha1
Python ≫ Python Version3.7.0 Updatealpha2
Python ≫ Python Version3.7.0 Updatealpha3
Python ≫ Python Version3.7.0 Updatealpha4
Python ≫ Python Version3.7.0 Updatebeta1
Python ≫ Python Version3.7.0 Updatebeta2
Python ≫ Python Version3.7.0 Updatebeta3
Python ≫ Python Version3.7.0 Updatebeta4
Python ≫ Python Version3.7.0 Updatebeta5
Python ≫ Python Version3.7.0 Updaterc1
Debian ≫ Debian Linux Version8.0
Debian ≫ Debian Linux Version9.0
Redhat ≫ Ansible Tower Version3.3
Canonical ≫ Ubuntu Linux Version12.04 SwEditionesm
Canonical ≫ Ubuntu Linux Version14.04 SwEditionlts
Canonical ≫ Ubuntu Linux Version16.04 SwEditionlts
Canonical ≫ Ubuntu Linux Version18.04 SwEditionlts
Fedoraproject ≫ Fedora Version28
Fedoraproject ≫ Fedora Version29
Fedoraproject ≫ Fedora Version30
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 4.98% 0.911
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 3.9 3.6
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:N/I:N/A:P
secalert@redhat.com 6.5 2.8 3.6
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html
https://access.redhat.com/errata/RHSA-2018:3505
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/09/msg00030.html
Third Party Advisory
Mailing List
https://lists.debian.org/debian-lts-announce/2018/09/msg00031.html
Third Party Advisory
Mailing List
https://www.debian.org/security/2018/dsa-4307
Third Party Advisory
https://access.redhat.com/errata/RHBA-2019:0327
Third Party Advisory
https://usn.ubuntu.com/3817-1/
Third Party Advisory
https://usn.ubuntu.com/3817-2/
Third Party Advisory
http://www.securitytracker.com/id/1042001
Third Party Advisory
VDB Entry
https://access.redhat.com/errata/RHSA-2018:3041
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1260
https://access.redhat.com/errata/RHSA-2019:3725
https://bugs.python.org/issue32981
Vendor Advisory
https://docs.python.org/3.5/whatsnew/changelog.html#python-3-5-6-release-candidate-1
Vendor Advisory
https://docs.python.org/3.6/whatsnew/changelog.html#python-3-6-5-release-candidate-1
Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46PVWY5LFP4BRPG3BVQ5QEEFYBVEXHCK/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AEZ5IQT7OF7Q2NCGIVABOWYGKO7YU3NJ/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JSKPGPZQNTAULHW4UH63KGOOUIDE4RRB/
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03951en_us
https://www.debian.org/security/2018/dsa-4306
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1061
Issue Tracking