NetSight
IP …
high7.5

CVE-2018-14647

Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization.

Impact

Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming large amounts CPU and RAM. The vulnerability exists in Python versions 3.7.0, 3.6.0 through 3.6.6, 3.5.0 through 3.5.6, 3.4.0 through 3.4.9, 2.7.0 through 2.7.15.

Affected products

VendorProductAffected versions
PythonPython
from 2.7.0 through 2.7.15
from 3.4.0 through 3.4.9
from 3.5.0 through 3.5.6
from 3.6.0 through 3.6.6
Version 3.7.0
CanonicalUbuntu Linux
Versions 12.04, 14.04, 16.04, 18.04
DebianDebian Linux
Versions 8.0, 9.0
FedoraprojectFedora
Version 30
OpensuseLeap
Version 15.1
RedhatEnterprise Linux Desktop
Version 7.0
RedhatEnterprise Linux Server
Version 7.0
RedhatEnterprise Linux Workstation
Version 7.0

Weakness classification

CWE-335CWE-665CWE-909

References