CVE-2018-1060

תיאור (מקור, אנגלית)

python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib's apop() method. An attacker could use this flaw to cause denial of service.

מדדים

CVSS 3.1

7.5 (HIGH) מקור הציון: NVD CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS — סבירות ניצול

5% (אחוזון 100) נכון ל-14/10/2026

CWE

CWE-20

מוצרים מושפעים

python: python; fedoraproject: fedora; canonical: ubuntu linux; redhat: ansible tower; redhat: enterprise linux desktop; redhat: enterprise linux server; redhat: enterprise linux workstation; debian: debian linux

קישורים

• https://bugs.python.org/issue32981 ExploitIssue TrackingVendor Advisory
• https://docs.python.org/3.5/whatsnew/changelog.html#python-3-5-6-release-candi‮… ProductVendor Advisory
• https://docs.python.org/3.6/whatsnew/changelog.html#python-3-6-5-release-candi‮… ProductVendor Advisory
• https://bugs.python.org/issue32981 ExploitIssue TrackingVendor Advisory
• https://docs.python.org/3.5/whatsnew/changelog.html#python-3-5-6-release-candi‮… ProductVendor Advisory
• https://docs.python.org/3.6/whatsnew/changelog.html#python-3-6-5-release-candi‮… ProductVendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html Mailing ListThird Party Advisory
• http://www.securitytracker.com/id/1042001 Third Party AdvisoryVDB Entry
• https://access.redhat.com/errata/RHBA-2019:0327 Third Party Advisory
• https://access.redhat.com/errata/RHSA-2018:3041 Third Party Advisory