CVE-2018-1060
Published: 18 June 2018
python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib's apop() method. An attacker could use this flaw to cause denial of service.
Priority
Status
| Package | Release | Status |
|---|---|---|
|
python2.7
Launchpad, Ubuntu, Debian |
artful |
Ignored
(end of life)
|
| bionic |
Not vulnerable
(2.7.15~rc1-1)
|
|
| cosmic |
Not vulnerable
(2.7.15-4ubuntu1)
|
|
| disco |
Not vulnerable
(2.7.15-4ubuntu1)
|
|
| eoan |
Not vulnerable
(2.7.15-4ubuntu1)
|
|
| focal |
Not vulnerable
(2.7.15-4ubuntu1)
|
|
| groovy |
Not vulnerable
(2.7.15-4ubuntu1)
|
|
| hirsute |
Not vulnerable
(2.7.15-4ubuntu1)
|
|
| impish |
Not vulnerable
(2.7.15-4ubuntu1)
|
|
| jammy |
Not vulnerable
(2.7.15-4ubuntu1)
|
|
| kinetic |
Not vulnerable
(2.7.15-4ubuntu1)
|
|
| lunar |
Does not exist
|
|
| mantic |
Does not exist
|
|
| noble |
Does not exist
|
|
| trusty |
Released
(2.7.6-8ubuntu0.5)
|
|
| upstream |
Needs triage
|
|
| xenial |
Released
(2.7.12-1ubuntu0~16.04.4)
|
|
|
Patches:
upstream: https://github.com/python/cpython/commit/e052d40cea15f582b50947f7d906b39744dc62a2 |
||
|
python3.4
Launchpad, Ubuntu, Debian |
artful |
Does not exist
|
| bionic |
Does not exist
|
|
| cosmic |
Does not exist
|
|
| disco |
Does not exist
|
|
| eoan |
Does not exist
|
|
| focal |
Does not exist
|
|
| groovy |
Does not exist
|
|
| hirsute |
Does not exist
|
|
| impish |
Does not exist
|
|
| jammy |
Does not exist
|
|
| kinetic |
Does not exist
|
|
| lunar |
Does not exist
|
|
| mantic |
Does not exist
|
|
| noble |
Does not exist
|
|
| trusty |
Released
(3.4.3-1ubuntu1~14.04.7)
|
|
| upstream |
Needs triage
|
|
| xenial |
Does not exist
|
|
|
Patches:
upstream: https://github.com/python/cpython/commit/942cc04ae44825ea120e3a19a80c9b348b8194d0 |
||
|
python3.5
Launchpad, Ubuntu, Debian |
artful |
Does not exist
|
| bionic |
Does not exist
|
|
| cosmic |
Does not exist
|
|
| disco |
Does not exist
|
|
| eoan |
Does not exist
|
|
| focal |
Does not exist
|
|
| groovy |
Does not exist
|
|
| hirsute |
Does not exist
|
|
| impish |
Does not exist
|
|
| jammy |
Does not exist
|
|
| kinetic |
Does not exist
|
|
| lunar |
Does not exist
|
|
| mantic |
Does not exist
|
|
| noble |
Does not exist
|
|
| trusty |
Released
(3.5.2-2ubuntu0~16.04.4~14.04.1+esm1)
Available with Ubuntu Pro or Ubuntu Pro (Infra-only) |
|
| upstream |
Needs triage
|
|
| xenial |
Released
(3.5.2-2ubuntu0~16.04.5)
|
|
|
Patches:
upstream: https://github.com/python/cpython/commit/937ac1fe069a4dc8471dff205f553d82e724015b |
||
|
python3.6
Launchpad, Ubuntu, Debian |
artful |
Ignored
(end of life)
|
| bionic |
Not vulnerable
(3.6.6-1~18.04)
|
|
| cosmic |
Not vulnerable
(3.6.6-4)
|
|
| disco |
Does not exist
|
|
| eoan |
Does not exist
|
|
| focal |
Does not exist
|
|
| groovy |
Does not exist
|
|
| hirsute |
Does not exist
|
|
| impish |
Does not exist
|
|
| jammy |
Does not exist
|
|
| kinetic |
Does not exist
|
|
| lunar |
Does not exist
|
|
| mantic |
Does not exist
|
|
| noble |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| xenial |
Does not exist
|
|
|
Patches:
upstream: https://github.com/python/cpython/commit/c9516754067d71fd7429a25ccfcb2141fc583523 |
||
|
python3.7
Launchpad, Ubuntu, Debian |
artful |
Ignored
(end of life)
|
| bionic |
Not vulnerable
(3.7.0~b3-1)
|
|
| cosmic |
Not vulnerable
(3.7.0-1)
|
|
| disco |
Not vulnerable
(3.7.0-1)
|
|
| eoan |
Not vulnerable
(3.7.0-1)
|
|
| focal |
Does not exist
|
|
| groovy |
Does not exist
|
|
| hirsute |
Does not exist
|
|
| impish |
Does not exist
|
|
| jammy |
Does not exist
|
|
| kinetic |
Does not exist
|
|
| lunar |
Does not exist
|
|
| mantic |
Does not exist
|
|
| noble |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| xenial |
Does not exist
|
|
|
Patches:
upstream: https://github.com/python/cpython/commit/0902a2d6b2d1d9dbde36aeaaccf1788ceaa97143 |
||
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 7.5 |
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | None |
| Integrity impact | None |
| Availability impact | High |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |