Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming large amounts CPU and RAM. The vulnerability exists in Python versions 3.7.0, 3.6.0 through 3.6.6, 3.5.0 through 3.5.6, 3.4.0 through 3.4.9, 2.7.0 through 2.7.15.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
- CVSS 3.0 Base Score: 5.3
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade python3Upgrade python2Upgrade python2-tkinter | Apr 24, 2019 | Sep 25, 2018 |
| Amazon Linux Ami 2 | — | Upgrade python3-libsUpgrade python3-toolsUpgrade python3-debuginfoUpgrade python3-develUpgrade python3-tkinterUpgrade python3Upgrade python3-debugUpgrade python3-test | Apr 27, 2020 | Sep 25, 2018 |
| Amazon_linux | — | Upgrade python34Upgrade python35Upgrade python36 | Nov 8, 2018 | Sep 24, 2018 |
| Centos_linux | — | Upgrade python-develUpgrade tkinterUpgrade python-libsUpgrade python-toolsUpgrade python-testUpgrade python-debuginfoUpgrade python-debugUpgrade python | Aug 28, 2019 | Sep 25, 2018 |
| Debian | — | Upgrade python2.7 | Sep 28, 2018 | Sep 24, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade python-libsUpgrade python-develUpgrade tkinterUpgrade python | Feb 22, 2019 | Sep 24, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade python-develUpgrade tkinterUpgrade python-libsUpgrade python | Sep 25, 2019 | Sep 25, 2018 |
| Huawei Euleros 2_0_sp5 | — | Upgrade python-develUpgrade python-libsUpgrade tkinterUpgrade python | May 7, 2019 | Sep 24, 2018 |
| Oracle Solaris | — | Upgrade runtime/python-35 to version 3.5.7-11.4.12.0.1.3.0 on Solaris 11.4Upgrade runtime/python-37 to version 3.7.4-11.4.12.0.1.3.0 on Solaris 11.4Upgrade library/python/tkinter-35 to version 3.5.7-11.4.12.0.1.3.0 on Solaris 11.4Upgrade library/python/tkinter-27 to version 2.7.16-0.175.3.36.0.26.0 on Solaris 11.3Upgrade runtime/python-27 to version 2.7.16-11.4.12.0.1.3.0 on Solaris 11.4Upgrade library/python/tkinter-27 to version 2.7.16-11.4.12.0.1.3.0 on Solaris 11.4Upgrade runtime/python-27 to version 2.7.16-0.175.3.36.0.26.0 on Solaris 11.3Upgrade runtime/python-27/tests to version 2.7.16-11.4.12.0.1.3.0 on Solaris 11.4Upgrade runtime/python-27/tests to version 2.7.16-0.175.3.36.0.26.0 on Solaris 11.3Upgrade runtime/python-34 to version 3.4.10-11.4.12.0.1.3.0 on Solaris 11.4Upgrade runtime/python-34 to version 3.4.10-0.175.3.36.0.26.0 on Solaris 11.3Upgrade library/python/tkinter-34 to version 3.4.10-0.175.3.36.0.26.0 on Solaris 11.3Upgrade library/python/tkinter-34 to version 3.4.10-11.4.12.0.1.3.0 on Solaris 11.4Upgrade library/python/tkinter-37 to version 3.7.4-11.4.12.0.1.3.0 on Solaris 11.4 | Aug 21, 2019 | Sep 25, 2018 |
| Oracle_linux | — | Upgrade python-debugUpgrade python-develUpgrade python-toolsUpgrade tkinterUpgrade pythonUpgrade python-testUpgrade python-libs | Jul 21, 2020 | Sep 22, 2018 |
| Redhat_linux | — | No solution existsUpgrade pythonUpgrade python-debugUpgrade python-libsUpgrade python-toolsUpgrade python-debuginfoUpgrade tkinterUpgrade python-testUpgrade python-devel | Aug 7, 2019 | Sep 25, 2018 |
| Suse | — | Upgrade python-idleUpgrade libpython3_4m1_0-32bitUpgrade python-demoUpgrade python-gdbmUpgrade libpython2_7-1_0Upgrade python-base-32bitUpgrade libpython2_6-1_0-32bitUpgrade python3Upgrade libpython2_6-1_0Upgrade libpython2_6-1_0-x86Upgrade python3-dbmUpgrade python3-cursesUpgrade python-x86Upgrade libpython2_7-1_0-32bitUpgrade python3-testsuiteUpgrade python-base-x86Upgrade python-32bitUpgrade python-baseUpgrade python3-toolsUpgrade pythonUpgrade python-doc-pdfUpgrade python3-develUpgrade python3-idleUpgrade python-tkUpgrade python-xmlUpgrade libpython3_6m1_0-32bitUpgrade python3-baseUpgrade python-develUpgrade python-cursesUpgrade python3-tkUpgrade python3-base-32bitUpgrade python-docUpgrade python3-32bitUpgrade libpython3_6m1_0Upgrade libpython3_4m1_0 | Oct 17, 2018 | Sep 24, 2018 |
| Ubuntu | — | Upgrade python2.7Upgrade python3.5Upgrade python2.7-minimalUpgrade python3.5-minimalUpgrade python3.5-minimal (Ubuntu Pro)Upgrade python3.4-minimalUpgrade python3.5 (Ubuntu Pro)Upgrade python3.4 | Nov 15, 2018 | Sep 24, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Sep 25, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub