Modules/_pickle.c in Python before 3.7.1 has an integer overflow via a large LONG_BINPUT value that is mishandled during a "resize to twice the size" attempt. This issue might cause memory exhaustion, but is only relevant if the pickle format is used for serializing tens or hundreds of gigabytes of data. This issue is fixed in: v3.4.10, v3.4.10rc1; v3.5.10, v3.5.10rc1, v3.5.7, v3.5.7rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.7, v3.6.7rc1, v3.6.7rc2, v3.6.8, v3.6.8rc1, v3.6.9, v3.6.9rc1; v3.7.1, v3.7.1rc1, v3.7.1rc2, v3.7.2, v3.7.2rc1, v3.7.3, v3.7.3rc1, v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade python3 | Apr 24, 2019 | Dec 23, 2018 |
| Amazon Linux Ami 2 | — | Upgrade python3-tkinterUpgrade python3-debugUpgrade pythonUpgrade python-debugUpgrade python3-debuginfoUpgrade python-debuginfoUpgrade python3-libsUpgrade python3-develUpgrade python3-testUpgrade python-libsUpgrade python-develUpgrade python3Upgrade python3-toolsUpgrade python-testUpgrade tkinterUpgrade python-tools | Apr 27, 2020 | Dec 23, 2018 |
| Amazon_linux | — | Upgrade python34 | May 7, 2019 | Dec 23, 2018 |
| Debian | — | Upgrade python3.7 | Feb 20, 2019 | Dec 23, 2018 |
| Oracle Solaris | — | Upgrade library/python/tkinter-37 to version 3.7.4-11.4.12.0.1.3.0 on Solaris 11.4Upgrade runtime/python-27 to version 2.7.16-11.4.12.0.1.3.0 on Solaris 11.4Upgrade runtime/python-27/tests to version 2.7.16-11.4.12.0.1.3.0 on Solaris 11.4Upgrade runtime/python-37 to version 3.7.4-11.4.12.0.1.3.0 on Solaris 11.4Upgrade library/python/tkinter-34 to version 3.4.10-0.175.3.36.0.26.0 on Solaris 11.3Upgrade runtime/python-35 to version 3.5.7-11.4.12.0.1.3.0 on Solaris 11.4Upgrade runtime/python-34 to version 3.4.10-11.4.12.0.1.3.0 on Solaris 11.4Upgrade library/python/tkinter-27 to version 2.7.16-11.4.12.0.1.3.0 on Solaris 11.4Upgrade library/python/tkinter-34 to version 3.4.10-11.4.12.0.1.3.0 on Solaris 11.4Upgrade runtime/python-34 to version 3.4.10-0.175.3.36.0.26.0 on Solaris 11.3Upgrade library/python/tkinter-35 to version 3.5.7-11.4.12.0.1.3.0 on Solaris 11.4 | Aug 21, 2019 | Dec 23, 2018 |
| Suse | — | Upgrade python3-base-32bitUpgrade firefox-libatk-1_0-0Upgrade firefox-gtk3-dataUpgrade libfirefox-gthread-2_0-0Upgrade firefox-gtk3-immodule-amharicUpgrade libfirefox-gio-2_0-0Upgrade firefox-gtk3-immodule-thaiUpgrade MozillaFirefox-translations-commonUpgrade python3-cursesUpgrade python36-baseUpgrade libpython3_4m1_0Upgrade mozilla-nspr-develUpgrade firefox-gtk3-immodule-inuktitutUpgrade mozilla-nss-toolsUpgrade libsoftokn3-32bitUpgrade firefox-libffi4Upgrade python3-develUpgrade mozilla-nss-32bitUpgrade firefox-gtk3-immodule-multipressUpgrade python3-idleUpgrade python3-tkUpgrade firefox-libgdk_pixbuf-2_0-0Upgrade libpython3_6m1_0Upgrade firefox-gtk3-immodules-tigrignaUpgrade python36Upgrade libfreebl3-32bitUpgrade MozillaFirefoxUpgrade firefox-gtk3-langUpgrade firefox-gtk3-immodule-vietnameseUpgrade firefox-gdk-pixbuf-thumbnailerUpgrade libsoftokn3Upgrade python3-32bitUpgrade mozilla-nss-develUpgrade python3-testsuiteUpgrade firefox-libffi7Upgrade firefox-gtk3-immodule-ximUpgrade python3Upgrade libfirefox-gobject-2_0-0Upgrade firefox-gdk-pixbuf-query-loadersUpgrade firefox-libgtk-3-0Upgrade firefox-libcairo2Upgrade libfirefox-gmodule-2_0-0Upgrade python3-baseUpgrade MozillaFirefox-branding-SLEDUpgrade libfreebl3Upgrade firefox-gdk-pixbuf-langUpgrade firefox-gio-branding-upstreamUpgrade python3-dbmUpgrade firefox-libpango-1_0-0Upgrade firefox-glib2-toolsUpgrade MozillaFirefox-translations-otherUpgrade libfirefox-glib-2_0-0Upgrade firefox-atk-langUpgrade libpython3_6m1_0-32bitUpgrade firefox-glib2-langUpgrade mozilla-nssUpgrade python3-docUpgrade firefox-gtk3-toolsUpgrade python3-toolsUpgrade mozilla-nss-certs-32bitUpgrade mozilla-nspr-32bitUpgrade firefox-libcairo-gobject2Upgrade firefox-gtk3-branding-upstreamUpgrade libpython3_4m1_0-32bitUpgrade mozilla-nss-certsUpgrade firefox-libharfbuzz0Upgrade mozilla-nspr | Feb 6, 2019 | Dec 23, 2018 |
| Ubuntu | — | Upgrade python3.6Upgrade python3.5 (Ubuntu Pro)Upgrade python3.5-minimal (Ubuntu Pro)Upgrade python2.7Upgrade python3.6-minimalUpgrade python3.4-minimal (Ubuntu Pro)Upgrade python3.4 (Ubuntu Pro)Upgrade python2.7 (Ubuntu Pro)Upgrade python3.5Upgrade python2.7-minimalUpgrade python3.5-minimalUpgrade python2.7-minimal (Ubuntu Pro) | Sep 10, 2019 | Dec 23, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Dec 23, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub