Modules/_pickle.c in Python before 3.7.1 has an integer overflow via a large LONG_BINPUT value that is mishandled during a "resize to twice the size" attempt. This issue might cause memory exhaustion, but is only relevant if the pickle format is used for serializing tens or hundreds of gigabytes of data. This issue is fixed in: v3.4.10, v3.4.10rc1; v3.5.10, v3.5.10rc1, v3.5.7, v3.5.7rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.7, v3.6.7rc1, v3.6.7rc2, v3.6.8, v3.6.8rc1, v3.6.9, v3.6.9rc1; v3.7.1, v3.7.1rc1, v3.7.1rc2, v3.7.2, v3.7.2rc1, v3.7.3, v3.7.3rc1, v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade python3 | Apr 24, 2019 | Dec 23, 2018 |
| Amazon Linux Ami 2 | — | Upgrade python3-develUpgrade python-debuginfoUpgrade python3-debuginfoUpgrade python-debugUpgrade python3-tkinterUpgrade python3-libsUpgrade python3-debugUpgrade pythonUpgrade python3-toolsUpgrade python3-testUpgrade python-toolsUpgrade python-develUpgrade python-testUpgrade tkinterUpgrade python-libsUpgrade python3 | Apr 27, 2020 | Dec 23, 2018 |
| Amazon_linux | — | Upgrade python34 | May 7, 2019 | Dec 23, 2018 |
| Debian | — | Upgrade python3.7 | Feb 20, 2019 | Dec 23, 2018 |
| Oracle Solaris | — | Upgrade library/python/tkinter-37 to version 3.7.4-11.4.12.0.1.3.0 on Solaris 11.4Upgrade runtime/python-27/tests to version 2.7.16-11.4.12.0.1.3.0 on Solaris 11.4Upgrade runtime/python-27 to version 2.7.16-11.4.12.0.1.3.0 on Solaris 11.4Upgrade runtime/python-34 to version 3.4.10-11.4.12.0.1.3.0 on Solaris 11.4Upgrade library/python/tkinter-34 to version 3.4.10-11.4.12.0.1.3.0 on Solaris 11.4Upgrade runtime/python-34 to version 3.4.10-0.175.3.36.0.26.0 on Solaris 11.3Upgrade library/python/tkinter-35 to version 3.5.7-11.4.12.0.1.3.0 on Solaris 11.4Upgrade runtime/python-35 to version 3.5.7-11.4.12.0.1.3.0 on Solaris 11.4Upgrade library/python/tkinter-27 to version 2.7.16-11.4.12.0.1.3.0 on Solaris 11.4Upgrade library/python/tkinter-34 to version 3.4.10-0.175.3.36.0.26.0 on Solaris 11.3Upgrade runtime/python-37 to version 3.7.4-11.4.12.0.1.3.0 on Solaris 11.4 | Aug 21, 2019 | Dec 23, 2018 |
| Suse | — | Upgrade libfirefox-gobject-2_0-0Upgrade firefox-libcairo2Upgrade firefox-libgtk-3-0Upgrade python3-toolsUpgrade firefox-libcairo-gobject2Upgrade firefox-gtk3-branding-upstreamUpgrade mozilla-nss-certsUpgrade python3-docUpgrade firefox-gdk-pixbuf-query-loadersUpgrade firefox-libffi7Upgrade libfreebl3Upgrade libfirefox-gmodule-2_0-0Upgrade libpython3_6m1_0-32bitUpgrade firefox-gtk3-immodule-ximUpgrade libfirefox-glib-2_0-0Upgrade MozillaFirefox-branding-SLEDUpgrade mozilla-nssUpgrade firefox-glib2-langUpgrade firefox-gdk-pixbuf-langUpgrade firefox-libpango-1_0-0Upgrade firefox-gtk3-toolsUpgrade python3-dbmUpgrade mozilla-nsprUpgrade firefox-gio-branding-upstreamUpgrade firefox-glib2-toolsUpgrade firefox-libharfbuzz0Upgrade libpython3_4m1_0-32bitUpgrade python3-baseUpgrade firefox-atk-langUpgrade MozillaFirefox-translations-otherUpgrade mozilla-nss-certs-32bitUpgrade mozilla-nspr-32bitUpgrade python3Upgrade firefox-gtk3-immodule-inuktitutUpgrade python3-tkUpgrade firefox-gtk3-immodule-multipressUpgrade mozilla-nspr-develUpgrade MozillaFirefoxUpgrade python3-idleUpgrade MozillaFirefox-translations-commonUpgrade python3-32bitUpgrade python3-develUpgrade libfreebl3-32bitUpgrade firefox-libffi4Upgrade firefox-gtk3-immodule-vietnameseUpgrade firefox-gtk3-immodules-tigrignaUpgrade libsoftokn3Upgrade firefox-libatk-1_0-0Upgrade mozilla-nss-develUpgrade python3-testsuiteUpgrade firefox-libgdk_pixbuf-2_0-0Upgrade libpython3_6m1_0Upgrade firefox-gtk3-langUpgrade firefox-gdk-pixbuf-thumbnailerUpgrade python3-cursesUpgrade libpython3_4m1_0Upgrade firefox-gtk3-immodule-thaiUpgrade libfirefox-gthread-2_0-0Upgrade mozilla-nss-toolsUpgrade python36Upgrade python36-baseUpgrade python3-base-32bitUpgrade firefox-gtk3-dataUpgrade libfirefox-gio-2_0-0Upgrade mozilla-nss-32bitUpgrade libsoftokn3-32bitUpgrade firefox-gtk3-immodule-amharic | Feb 6, 2019 | Dec 23, 2018 |
| Ubuntu | — | Upgrade python3.6-minimalUpgrade python3.5-minimal (Ubuntu Pro)Upgrade python3.5 (Ubuntu Pro)Upgrade python3.6Upgrade python2.7Upgrade python3.5Upgrade python3.4-minimal (Ubuntu Pro)Upgrade python3.4 (Ubuntu Pro)Upgrade python2.7-minimal (Ubuntu Pro)Upgrade python2.7 (Ubuntu Pro)Upgrade python2.7-minimalUpgrade python3.5-minimal | Sep 10, 2019 | Dec 23, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Dec 23, 2018 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub