Modules/_pickle.c in Python before 3.7.1 has an integer overflow via a large LONG_BINPUT value that is mishandled during a "resize to twice the size" attempt. This issue might cause memory exhaustion, but is only relevant if the pickle format is used for serializing tens or hundreds of gigabytes of data. This issue is fixed in: v3.4.10, v3.4.10rc1; v3.5.10, v3.5.10rc1, v3.5.7, v3.5.7rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.7, v3.6.7rc1, v3.6.7rc2, v3.6.8, v3.6.8rc1, v3.6.9, v3.6.9rc1; v3.7.1, v3.7.1rc1, v3.7.1rc2, v3.7.2, v3.7.2rc1, v3.7.3, v3.7.3rc1, v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade python3 | Apr 24, 2019 | Dec 23, 2018 |
| Amazon Linux Ami 2 | — | Upgrade python3-tkinterUpgrade python3-debugUpgrade python3-libsUpgrade pythonUpgrade python-debuginfoUpgrade python3-develUpgrade python3-debuginfoUpgrade python-debugUpgrade python-develUpgrade tkinterUpgrade python-testUpgrade python3-toolsUpgrade python3Upgrade python3-testUpgrade python-toolsUpgrade python-libs | Apr 27, 2020 | Dec 23, 2018 |
| Amazon_linux | — | Upgrade python34 | May 7, 2019 | Dec 23, 2018 |
| Debian | — | Upgrade python3.7 | Feb 20, 2019 | Dec 23, 2018 |
| Oracle Solaris | — | Upgrade library/python/tkinter-37 to version 3.7.4-11.4.12.0.1.3.0 on Solaris 11.4Upgrade runtime/python-27/tests to version 2.7.16-11.4.12.0.1.3.0 on Solaris 11.4Upgrade runtime/python-27 to version 2.7.16-11.4.12.0.1.3.0 on Solaris 11.4Upgrade runtime/python-37 to version 3.7.4-11.4.12.0.1.3.0 on Solaris 11.4Upgrade runtime/python-34 to version 3.4.10-11.4.12.0.1.3.0 on Solaris 11.4Upgrade library/python/tkinter-34 to version 3.4.10-11.4.12.0.1.3.0 on Solaris 11.4Upgrade runtime/python-34 to version 3.4.10-0.175.3.36.0.26.0 on Solaris 11.3Upgrade library/python/tkinter-34 to version 3.4.10-0.175.3.36.0.26.0 on Solaris 11.3Upgrade library/python/tkinter-35 to version 3.5.7-11.4.12.0.1.3.0 on Solaris 11.4Upgrade library/python/tkinter-27 to version 2.7.16-11.4.12.0.1.3.0 on Solaris 11.4Upgrade runtime/python-35 to version 3.5.7-11.4.12.0.1.3.0 on Solaris 11.4 | Aug 21, 2019 | Dec 23, 2018 |
| Suse | — | Upgrade firefox-libatk-1_0-0Upgrade firefox-gtk3-immodule-multipressUpgrade libfirefox-gthread-2_0-0Upgrade libsoftokn3Upgrade python3-testsuiteUpgrade mozilla-nss-develUpgrade firefox-gtk3-immodule-vietnameseUpgrade libsoftokn3-32bitUpgrade firefox-gtk3-langUpgrade firefox-gtk3-immodules-tigrignaUpgrade firefox-gtk3-immodule-thaiUpgrade mozilla-nss-32bitUpgrade firefox-libffi4Upgrade python3-base-32bitUpgrade python36-baseUpgrade python3-develUpgrade python3-cursesUpgrade firefox-gtk3-dataUpgrade python36Upgrade mozilla-nss-toolsUpgrade python3-tkUpgrade libfirefox-gio-2_0-0Upgrade libfreebl3-32bitUpgrade firefox-gtk3-immodule-amharicUpgrade firefox-gtk3-immodule-inuktitutUpgrade python3-idleUpgrade mozillafirefox-translations-otherUpgrade libpython3_4m1_0Upgrade firefox-gdk-pixbuf-thumbnailerUpgrade mozilla-nspr-develUpgrade firefox-libgdk_pixbuf-2_0-0Upgrade python3-32bitUpgrade libpython3_6m1_0Upgrade mozilla-nssUpgrade mozillafirefox-branding-sledUpgrade firefox-gio-branding-upstreamUpgrade firefox-libffi7Upgrade libpython3_4m1_0-32bitUpgrade libfirefox-gmodule-2_0-0Upgrade libfreebl3Upgrade libfirefox-glib-2_0-0Upgrade firefox-libcairo2Upgrade python3-toolsUpgrade firefox-libcairo-gobject2Upgrade mozillafirefox-translations-commonUpgrade firefox-gtk3-branding-upstreamUpgrade mozilla-nss-certsUpgrade python3-dbmUpgrade firefox-libpango-1_0-0Upgrade firefox-glib2-langUpgrade firefox-libharfbuzz0Upgrade libpython3_6m1_0-32bitUpgrade mozilla-nsprUpgrade python3-baseUpgrade firefox-gtk3-immodule-ximUpgrade mozilla-nspr-32bitUpgrade python3Upgrade python3-docUpgrade firefox-atk-langUpgrade libfirefox-gobject-2_0-0Upgrade firefox-gtk3-toolsUpgrade firefox-glib2-toolsUpgrade mozilla-nss-certs-32bitUpgrade firefox-libgtk-3-0Upgrade firefox-gdk-pixbuf-langUpgrade mozillafirefoxUpgrade firefox-gdk-pixbuf-query-loaders | Feb 6, 2019 | Dec 23, 2018 |
| Ubuntu | — | Upgrade python3.6Upgrade python3.5-minimal (Ubuntu Pro)Upgrade python3.6-minimalUpgrade python3.5 (Ubuntu Pro)Upgrade python2.7Upgrade python2.7-minimalUpgrade python2.7 (Ubuntu Pro)Upgrade python3.4 (Ubuntu Pro)Upgrade python3.5-minimalUpgrade python2.7-minimal (Ubuntu Pro)Upgrade python3.4-minimal (Ubuntu Pro)Upgrade python3.5 | Sep 10, 2019 | Dec 23, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Dec 23, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub