5
CVSSv2

CVE-2018-14647

Published: 25/09/2018 Updated: 07/11/2023
CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10
CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9
VMScore: 446
Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

Vulnerability Summary

Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming large amounts CPU and RAM. The vulnerability exists in Python versions 3.7.0, 3.6.0 up to and including 3.6.6, 3.5.0 up to and including 3.5.6, 3.4.0 up to and including 3.4.9, 2.7.0 up to and including 2.7.15.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

python python

python python 3.7.0

canonical ubuntu linux 16.04

canonical ubuntu linux 12.04

canonical ubuntu linux 18.04

canonical ubuntu linux 14.04

debian debian linux 8.0

debian debian linux 9.0

fedoraproject fedora 30

opensuse leap 15.1

redhat enterprise linux desktop 7.0

redhat enterprise linux workstation 7.0

redhat enterprise linux server 7.0

Vendor Advisories

Multiple security issues were discovered in Python: ElementTree failed to initialise Expat's hash salt, two denial of service issues were found in difflib and poplib and a buffer overflow in PyString_DecodeEscape For the stable distribution (stretch), these problems have been fixed in version 353-1+deb9u1 We recommend that you upgrade your pyth ...
Debian Bug report logs - #921040 python27: CVE-2019-5010: NULL pointer dereference using a specially crafted X509 certificate Package: python27; Maintainer for python27 is Matthias Klose <doko@debianorg>; Source for python27 is src:python27 (PTS, buildd, popcon) Reported by: Moritz Muehlenhoff <jmm@debianorg> ...
Debian Bug report logs - #921039 CVE-2018-14647 Package: python27; Maintainer for python27 is Matthias Klose <doko@debianorg>; Source for python27 is src:python27 (PTS, buildd, popcon) Reported by: Moritz Muehlenhoff <jmm@debianorg> Date: Thu, 31 Jan 2019 23:36:02 UTC Severity: grave Tags: security, upstream ...
Several security issues were fixed in Python ...
Several security issues were fixed in Python ...
Synopsis Moderate: python security and bug fix update Type/Severity Security Advisory: Moderate Topic An update for python is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) base ...
Synopsis Moderate: python security update Type/Severity Security Advisory: Moderate Topic An update for python is now available for Red Hat Enterprise Linux 75 Extended Update SupportRed Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring Syst ...
Synopsis Moderate: rh-python36-python security, bug fix, and enhancement update Type/Severity Security Advisory: Moderate Topic An update for rh-python36-python is now available for Red Hat Software CollectionsRed Hat Product Security has rated this update as having a security impact of Moderate A Common ...
Synopsis Moderate: python security update Type/Severity Security Advisory: Moderate Topic An update for python is now available for Red Hat Enterprise Linux 76 Extended Update SupportRed Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring Syst ...
Synopsis Moderate: python security update Type/Severity Security Advisory: Moderate Topic An update for python is now available for Red Hat Enterprise Linux 74 Advanced Update Support, Red Hat Enterprise Linux 74 Telco Extended Update Support, and Red Hat Enterprise Linux 74 Update Services for SAP Solut ...
Synopsis Important: python27-python and python27-python-jinja2 security and bug fix update Type/Severity Security Advisory: Important Topic An update for python27-python and python27-python-jinja2 is now available for Red Hat Software CollectionsRed Hat Product Security has rated this update as having a se ...
Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization This could make it easy to conduct denial of service attacks against Expat by contructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming large amounts CPU and RAM(CVE-2018-14647) ...
Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization This could make it easy to conduct denial of service attacks against Expat by contructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming large amounts CPU and RAM(CVE-2018-14647) ...
Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization This could make it easy to conduct denial of service attacks against Expat by contructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming large amounts CPU and RAM(CVE-2018-14647) ...
Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization This could make it easy to conduct denial of service attacks against Expat by contructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming large amounts CPU and RAM ...