Vulnerability Description
Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming large amounts CPU and RAM. The vulnerability exists in Python versions 3.7.0, 3.6.0 through 3.6.6, 3.5.0 through 3.5.6, 3.4.0 through 3.4.9, 2.7.0 through 2.7.15.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Python | Python | >= 2.7.0, <= 2.7.15 |
| Canonical | Ubuntu Linux | 12.04 |
| Debian | Debian Linux | 8.0 |
| Fedoraproject | Fedora | 30 |
| Opensuse | Leap | 15.1 |
| Redhat | Enterprise Linux Desktop | 7.0 |
| Redhat | Enterprise Linux Server | 7.0 |
| Redhat | Enterprise Linux Workstation | 7.0 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.htmlMailing ListThird Party Advisory
- http://www.securityfocus.com/bid/105396Third Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1041740Third Party AdvisoryVDB Entry
- https://access.redhat.com/errata/RHSA-2019:1260Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2030Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:3725Third Party Advisory
- https://bugs.python.org/issue34623Issue TrackingPatchVendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14647Issue TrackingThird Party Advisory
- https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab
- https://lists.debian.org/debian-lts-announce/2019/06/msg00022.htmlMailing ListThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/06/msg00023.htmlMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://usn.ubuntu.com/3817-1/Third Party Advisory
- https://usn.ubuntu.com/3817-2/Third Party Advisory
- https://www.debian.org/security/2018/dsa-4306Third Party Advisory
FAQ
What is CVE-2018-14647?
CVE-2018-14647 is a vulnerability with a CVSS score of 7.5 (HIGH). Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML docum...
How severe is CVE-2018-14647?
CVE-2018-14647 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-14647?
Check the references section above for vendor advisories and patch information. Affected products include: Python Python, Canonical Ubuntu Linux, Debian Debian Linux, Fedoraproject Fedora, Opensuse Leap.