תיאור (מקור, אנגלית)
Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming large amounts CPU and RAM. The vulnerability exists in Python versions 3.7.0, 3.6.0 through 3.6.6, 3.5.0 through 3.5.6, 3.4.0 through 3.4.9, 2.7.0 through 2.7.15.
מוצרים מושפעים
python: python; canonical: ubuntu linux; debian: debian linux; fedoraproject: fedora; opensuse: leap; redhat: enterprise linux desktop; redhat: enterprise linux server; redhat: enterprise linux workstation
קישורים10
- bugs.python.org/issue34623 Issue TrackingPatchVendor Advisory
- bugs.python.org/issue34623 Issue TrackingPatchVendor Advisory
- lists.opensuse.org/opensuse-security-announce/2020-01/msg00040… Mailing ListThird Party Advisory
- www.securityfocus.com/bid/105396 Third Party AdvisoryVDB Entry
- www.securitytracker.com/id/1041740 Third Party AdvisoryVDB Entry
- access.redhat.com/errata/RHSA-2019:1260 Third Party Advisory
- access.redhat.com/errata/RHSA-2019:2030 Third Party Advisory
- access.redhat.com/errata/RHSA-2019:3725 Third Party Advisory
- bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14647 Issue TrackingThird Party Advisory
- lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b4…
מדדים
- CVSS 3.1
-
7.5
HIGH
מקור הציון: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - EPSS — סבירות ניצול
- 11% אחוזון 96 · נכון ל-3 בנובמבר 2026
- CWE
- CWE-335CWE-665CWE-909
האם אפשר לנצל את הפגיעות הזו אצלכם?
עדכון אבטחה סוגר את הפרצה הידועה. בדיקת חדירות מראה לאן תוקף עדיין יכול להגיע — עם הוכחה.