CVE-2018-1060
Published: 18 June 2018
python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib's apop() method. An attacker could use this flaw to cause denial of service.
Priority
Low
CVSS 3 base score: 7.5
Status
| Package | Release | Status |
|---|---|---|
|
python2.7 Launchpad, Ubuntu, Debian |
artful |
Ignored
(reached end-of-life)
|
| bionic |
Not vulnerable
(2.7.15~rc1-1)
|
|
| cosmic |
Not vulnerable
(2.7.15-4ubuntu1)
|
|
| disco |
Not vulnerable
(2.7.15-4ubuntu1)
|
|
| eoan |
Not vulnerable
(2.7.15-4ubuntu1)
|
|
| focal |
Not vulnerable
(2.7.15-4ubuntu1)
|
|
| groovy |
Not vulnerable
(2.7.15-4ubuntu1)
|
|
| hirsute |
Not vulnerable
(2.7.15-4ubuntu1)
|
|
| impish |
Not vulnerable
(2.7.15-4ubuntu1)
|
|
| jammy |
Not vulnerable
(2.7.15-4ubuntu1)
|
|
| precise |
Released
(2.7.3-0ubuntu3.11)
|
|
| trusty |
Released
(2.7.6-8ubuntu0.5)
|
|
| upstream |
Needs triage
|
|
| xenial |
Released
(2.7.12-1ubuntu0~16.04.4)
|
|
|
Patches: upstream: https://github.com/python/cpython/commit/e052d40cea15f582b50947f7d906b39744dc62a2 |
||
|
python3.4 Launchpad, Ubuntu, Debian |
artful |
Does not exist
|
| bionic |
Does not exist
|
|
| cosmic |
Does not exist
|
|
| disco |
Does not exist
|
|
| eoan |
Does not exist
|
|
| focal |
Does not exist
|
|
| groovy |
Does not exist
|
|
| hirsute |
Does not exist
|
|
| impish |
Does not exist
|
|
| jammy |
Does not exist
|
|
| precise |
Does not exist
|
|
| trusty |
Released
(3.4.3-1ubuntu1~14.04.7)
|
|
| upstream |
Needs triage
|
|
| xenial |
Does not exist
|
|
|
Patches: upstream: https://github.com/python/cpython/commit/942cc04ae44825ea120e3a19a80c9b348b8194d0 |
||
|
python3.5 Launchpad, Ubuntu, Debian |
artful |
Does not exist
|
| bionic |
Does not exist
|
|
| cosmic |
Does not exist
|
|
| disco |
Does not exist
|
|
| eoan |
Does not exist
|
|
| focal |
Does not exist
|
|
| groovy |
Does not exist
|
|
| hirsute |
Does not exist
|
|
| impish |
Does not exist
|
|
| jammy |
Does not exist
|
|
| precise |
Does not exist
|
|
| trusty |
Needed
|
|
| upstream |
Needs triage
|
|
| xenial |
Released
(3.5.2-2ubuntu0~16.04.5)
|
|
|
Patches: upstream: https://github.com/python/cpython/commit/937ac1fe069a4dc8471dff205f553d82e724015b |
||
|
python3.6 Launchpad, Ubuntu, Debian |
artful |
Ignored
(reached end-of-life)
|
| bionic |
Not vulnerable
(3.6.6-1~18.04)
|
|
| cosmic |
Not vulnerable
(3.6.6-4)
|
|
| disco |
Does not exist
|
|
| eoan |
Does not exist
|
|
| focal |
Does not exist
|
|
| groovy |
Does not exist
|
|
| hirsute |
Does not exist
|
|
| impish |
Does not exist
|
|
| jammy |
Does not exist
|
|
| precise |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| xenial |
Does not exist
|
|
|
Patches: upstream: https://github.com/python/cpython/commit/c9516754067d71fd7429a25ccfcb2141fc583523 |
||
|
python3.7 Launchpad, Ubuntu, Debian |
artful |
Ignored
(reached end-of-life)
|
| bionic |
Not vulnerable
(3.7.0~b3-1)
|
|
| cosmic |
Not vulnerable
(3.7.0-1)
|
|
| disco |
Not vulnerable
(3.7.0-1)
|
|
| eoan |
Not vulnerable
(3.7.0-1)
|
|
| focal |
Does not exist
|
|
| groovy |
Does not exist
|
|
| hirsute |
Does not exist
|
|
| impish |
Does not exist
|
|
| jammy |
Does not exist
|
|
| precise |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| xenial |
Does not exist
|
|
|
Patches: upstream: https://github.com/python/cpython/commit/0902a2d6b2d1d9dbde36aeaaccf1788ceaa97143 |
||