7.5

CVE-2018-14647

Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming large amounts CPU and RAM. The vulnerability exists in Python versions 3.7.0, 3.6.0 through 3.6.6, 3.5.0 through 3.5.6, 3.4.0 through 3.4.9, 2.7.0 through 2.7.15.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Python ≫ Python Version >= 2.7.0 <= 2.7.15
Python ≫ Python Version >= 3.4.0 <= 3.4.9
Python ≫ Python Version >= 3.5.0 <= 3.5.6
Python ≫ Python Version >= 3.6.0 <= 3.6.6
Python ≫ Python Version 3.7.0
Canonical ≫ Ubuntu Linux Version 12.04 SwEdition esm
Canonical ≫ Ubuntu Linux Version 14.04 SwEdition esm
Canonical ≫ Ubuntu Linux Version 16.04 SwEdition lts
Canonical ≫ Ubuntu Linux Version 18.04 SwEdition lts
Debian ≫ Debian Linux Version 8.0
Debian ≫ Debian Linux Version 9.0
Fedoraproject ≫ Fedora Version 30
Opensuse ≫ Leap Version 15.1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 10.91% 0.955
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NIST 5 10 2.9
AV:N/AC:L/Au:N/C:N/I:N/A:P
RedHat 5.3 3.9 1.4
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE-335 Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)

The product uses a Pseudo-Random Number Generator (PRNG) but does not correctly manage seeds.

CWE-665 Improper Initialization

The product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.

CWE-909 Missing Initialization of Resource

The product does not initialize a critical resource.

http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html
Third Party Advisory
Mailing List
https://www.debian.org/security/2018/dsa-4307
Third Party Advisory
https://usn.ubuntu.com/3817-1/
Third Party Advisory
https://usn.ubuntu.com/3817-2/
Third Party Advisory
https://www.debian.org/security/2018/dsa-4306
Third Party Advisory
http://www.securityfocus.com/bid/105396
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1041740
Third Party Advisory
VDB Entry
https://bugs.python.org/issue34623
Patch
Vendor Advisory
Issue Tracking
https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html
Third Party Advisory
Mailing List
https://lists.debian.org/debian-lts-announce/2019/06/msg00023.html
Third Party Advisory
Mailing List
https://access.redhat.com/errata/RHSA-2019:1260
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2030
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3725
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14647
Third Party Advisory
Issue Tracking
https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RBJCB2HWOJLP3L7CUQHJHNBHLSVOXJE5/