Vulnerability in Python
CVE-2018-14647
Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming large amounts CPU and RAM. The vulnerability exists in Python versions 3.7.0, 3.6.0 through 3.6.6, 3.5.0 through 3.5.6, 3.4.0 through 3.4.9, 2.7.0 through 2.7.15.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.109 (95.7th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 96th percentile — 95.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.109 · newest: 0.109 · change: 0.000
Affected products
- Python — versions 3.7.0
- The Python Project — versions 3.8, 3.7, 3.6, 3.5, 3.4, 2.7
- Canonical Ubuntu Linux — versions 12.04, 14.04, 16.04
- Debian Linux — versions 8.0, 9.0
- Fedoraproject Fedora — versions 30
- openSUSE Leap — versions 15.1
- Red Hat Enterprise Linux Desktop — versions 7.0
- Red Hat Enterprise Linux Server — versions 7.0
- Red Hat Enterprise Linux Workstation — versions 7.0
Weakness classification (CWE)
References
- www.debian.org/security/2018/dsa-4306 (vendor-advisory, Third Party Advisory)
- usn.ubuntu.com/3817-2/ (vendor-advisory, Third Party Advisory)
- www.securitytracker.com/id/1041740 (VDB Entry, Third Party Advisory, vdb-entry)
- www.securityfocus.com/bid/105396 (VDB Entry, Third Party Advisory, vdb-entry)
- www.debian.org/security/2018/dsa-4307 (vendor-advisory, Third Party Advisory)
- bugs.python.org/issue34623 (Patch, Issue Tracking, Vendor Advisory)
- usn.ubuntu.com/3817-1/ (vendor-advisory, Third Party Advisory)
- bugzilla.redhat.com/show_bug.cgi (Third Party Advisory, Issue Tracking)
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory)
- access.redhat.com/errata/RHSA-2019:1260 (vendor-advisory, Third Party Advisory)
Frequently asked questions
- What is CVE-2018-14647?
- CVE-2018-14647 is a high-severity vulnerability in Python, classified under Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG). CVSS score: 7.5/10. Published 2018-09-25.
- How severe is CVE-2018-14647?
- High severity. CVSS v3 base score is 7.5 out of 10.