CVE-2018-1060

NameCVE-2018-1060
Descriptionpython before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib's apop() method. An attacker could use this flaw to cause denial of service.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-1519-1, DLA-1520-1, DSA-4306-1, DSA-4307-1, ELA-47-1, ELA-48-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
python2.7 (PTS)jessie, jessie (lts)2.7.9-2-ds1-1+deb8u11fixed
stretch (security)2.7.13-2+deb9u6fixed
stretch (lts), stretch2.7.13-2+deb9u8fixed
buster2.7.16-2+deb10u1fixed
buster (security)2.7.16-2+deb10u3fixed
bullseye2.7.18-8+deb11u1fixed
python3.4 (PTS)jessie, jessie (lts)3.4.2-1+deb8u15fixed
python3.5 (PTS)stretch (security)3.5.3-1+deb9u5fixed
stretch (lts), stretch3.5.3-1+deb9u8fixed
python3.7 (PTS)buster3.7.3-2+deb10u3fixed
buster (security)3.7.3-2+deb10u6fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
python2.6sourcewheezy2.6.8-1.1+deb7u2ELA-48-1
python2.6source(unstable)(unfixed)low
python2.7sourcewheezy2.7.3-6+deb7u5ELA-47-1
python2.7sourcejessie2.7.9-2+deb8u2DLA-1519-1
python2.7sourcestretch2.7.13-2+deb9u3DSA-4306-1
python2.7source(unstable)2.7.14-7low
python3.2source(unstable)(unfixed)low
python3.4sourcejessie3.4.2-1+deb8u1DLA-1520-1
python3.4source(unstable)(unfixed)low
python3.5sourcestretch3.5.3-1+deb9u1DSA-4307-1
python3.5source(unstable)3.5.6-1low
python3.6source(unstable)3.6.5~rc1-1low
python3.7source(unstable)3.7.0~b3-1low

Notes

[wheezy] - python3.2 <no-dsa> (Minor issue)
[wheezy] - python2.7 <no-dsa> (Minor issue)
[wheezy] - python2.6 <no-dsa> (Minor issue)
https://bugs.python.org/issue32981
https://github.com/python/cpython/commit/0e6c8ee2358a2e23117501826c008842acb835ac (master)
https://github.com/python/cpython/commit/0902a2d6b2d1d9dbde36aeaaccf1788ceaa97143 (3.7)
https://github.com/python/cpython/commit/c9516754067d71fd7429a25ccfcb2141fc583523 (3.6)
https://github.com/python/cpython/commit/937ac1fe069a4dc8471dff205f553d82e724015b (3.5)
https://github.com/python/cpython/commit/942cc04ae44825ea120e3a19a80c9b348b8194d0 (3.4)
https://github.com/python/cpython/commit/e052d40cea15f582b50947f7d906b39744dc62a2 (2.7)

Search for package or bug name: Reporting problems