Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming large amounts CPU and RAM. The vulnerability exists in Python versions 3.7.0, 3.6.0 through 3.6.6, 3.5.0 through 3.5.6, 3.4.0 through 3.4.9, 2.7.0 through 2.7.15.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
- CVSS 3.0 Base Score: 5.3
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | alpine-linux-upgrade-python2alpine-linux-upgrade-python2-tkinteralpine-linux-upgrade-python3 | Apr 24, 2019 | Sep 25, 2018 | |
| Amazon Linux Ami 2 | amazon-linux-ami-2-upgrade-python3amazon-linux-ami-2-upgrade-python3-debugamazon-linux-ami-2-upgrade-python3-debuginfoamazon-linux-ami-2-upgrade-python3-develamazon-linux-ami-2-upgrade-python3-libsamazon-linux-ami-2-upgrade-python3-testamazon-linux-ami-2-upgrade-python3-tkinteramazon-linux-ami-2-upgrade-python3-tools | Apr 27, 2020 | Sep 25, 2018 | |
| Amazon_linux | — | amazon-linux-upgrade--python36amazon-linux-upgrade-python34amazon-linux-upgrade-python35 | Nov 8, 2018 | Sep 24, 2018 |
| Centos_linux | — | centos-upgrade-pythoncentos-upgrade-python-debugcentos-upgrade-python-debuginfocentos-upgrade-python-develcentos-upgrade-python-libscentos-upgrade-python-testcentos-upgrade-python-toolscentos-upgrade-tkinter | Aug 28, 2019 | Sep 25, 2018 |
| Debian | debian-upgrade-python2-7 | Sep 28, 2018 | Sep 24, 2018 | |
| Huawei Euleros 2_0_sp2 | huawei-euleros-2_0_sp2-upgrade-pythonhuawei-euleros-2_0_sp2-upgrade-python-develhuawei-euleros-2_0_sp2-upgrade-python-libshuawei-euleros-2_0_sp2-upgrade-tkinter | Feb 22, 2019 | Sep 24, 2018 | |
| Huawei Euleros 2_0_sp3 | huawei-euleros-2_0_sp3-upgrade-pythonhuawei-euleros-2_0_sp3-upgrade-python-develhuawei-euleros-2_0_sp3-upgrade-python-libshuawei-euleros-2_0_sp3-upgrade-tkinter | Sep 25, 2019 | Sep 25, 2018 | |
| Huawei Euleros 2_0_sp5 | huawei-euleros-2_0_sp5-upgrade-pythonhuawei-euleros-2_0_sp5-upgrade-python-develhuawei-euleros-2_0_sp5-upgrade-python-libshuawei-euleros-2_0_sp5-upgrade-tkinter | May 7, 2019 | Sep 24, 2018 | |
| Oracle Solaris | oracle-solaris-11-3-upgrade-library-python-tkinter-27-2-7-16-0-175-3-36-0-26-0oracle-solaris-11-3-upgrade-library-python-tkinter-34-3-4-10-0-175-3-36-0-26-0oracle-solaris-11-3-upgrade-runtime-python-27-2-7-16-0-175-3-36-0-26-0oracle-solaris-11-3-upgrade-runtime-python-27-tests-2-7-16-0-175-3-36-0-26-0oracle-solaris-11-3-upgrade-runtime-python-34-3-4-10-0-175-3-36-0-26-0oracle-solaris-11-4-upgrade-library-python-tkinter-27-2-7-16-11-4-12-0-1-3-0oracle-solaris-11-4-upgrade-library-python-tkinter-34-3-4-10-11-4-12-0-1-3-0oracle-solaris-11-4-upgrade-library-python-tkinter-35-3-5-7-11-4-12-0-1-3-0oracle-solaris-11-4-upgrade-library-python-tkinter-37-3-7-4-11-4-12-0-1-3-0oracle-solaris-11-4-upgrade-runtime-python-27-2-7-16-11-4-12-0-1-3-0oracle-solaris-11-4-upgrade-runtime-python-27-tests-2-7-16-11-4-12-0-1-3-0oracle-solaris-11-4-upgrade-runtime-python-34-3-4-10-11-4-12-0-1-3-0oracle-solaris-11-4-upgrade-runtime-python-35-3-5-7-11-4-12-0-1-3-0oracle-solaris-11-4-upgrade-runtime-python-37-3-7-4-11-4-12-0-1-3-0 | Aug 21, 2019 | Sep 25, 2018 | |
| Oracle_linux | — | oracle-linux-upgrade-pythonoracle-linux-upgrade-python-debugoracle-linux-upgrade-python-develoracle-linux-upgrade-python-libsoracle-linux-upgrade-python-testoracle-linux-upgrade-python-toolsoracle-linux-upgrade-tkinter | Jul 21, 2020 | Sep 22, 2018 |
| Redhat_linux | no-fix-redhat-rpm-packageredhat-upgrade-pythonredhat-upgrade-python-debugredhat-upgrade-python-debuginforedhat-upgrade-python-develredhat-upgrade-python-libsredhat-upgrade-python-testredhat-upgrade-python-toolsredhat-upgrade-tkinter | Aug 7, 2019 | Sep 25, 2018 | |
| Suse | — | suse-upgrade-libpython2_6-1_0suse-upgrade-libpython2_6-1_0-32bitsuse-upgrade-libpython2_6-1_0-x86suse-upgrade-libpython2_7-1_0suse-upgrade-libpython2_7-1_0-32bitsuse-upgrade-libpython3_4m1_0suse-upgrade-libpython3_4m1_0-32bitsuse-upgrade-libpython3_6m1_0suse-upgrade-libpython3_6m1_0-32bitsuse-upgrade-pythonsuse-upgrade-python-32bitsuse-upgrade-python-basesuse-upgrade-python-base-32bitsuse-upgrade-python-base-x86suse-upgrade-python-cursessuse-upgrade-python-demosuse-upgrade-python-develsuse-upgrade-python-docsuse-upgrade-python-doc-pdfsuse-upgrade-python-gdbmsuse-upgrade-python-idlesuse-upgrade-python-tksuse-upgrade-python-x86suse-upgrade-python-xmlsuse-upgrade-python3suse-upgrade-python3-32bitsuse-upgrade-python3-basesuse-upgrade-python3-base-32bitsuse-upgrade-python3-cursessuse-upgrade-python3-dbmsuse-upgrade-python3-develsuse-upgrade-python3-idlesuse-upgrade-python3-testsuitesuse-upgrade-python3-tksuse-upgrade-python3-tools | Oct 17, 2018 | Sep 24, 2018 |
| Ubuntu | ubuntu-pro-upgrade-python3-5ubuntu-pro-upgrade-python3-5-minimalubuntu-upgrade-python2-7ubuntu-upgrade-python2-7-minimalubuntu-upgrade-python3-4ubuntu-upgrade-python3-4-minimalubuntu-upgrade-python3-5ubuntu-upgrade-python3-5-minimal | Nov 15, 2018 | Sep 24, 2018 | |
| Vmware Photon_os | vmware-photon_os_update_tdnf | Jan 20, 2025 | Sep 25, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub