{"id":"CVE-2018-1060","title":"python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib's apop() method","summary":"python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib's apop() method. An attacker could use this flaw to cause denial of service.","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-20"],"vendor":"python","product":"python","affected":["python >= 2.7.0, < 2.7.15","python >= 3.0.0, < 3.4.9","python >= 3.5.0, < 3.5.6","python > 3.6.0, < 3.6.5","fedora = 28","fedora = 29","fedora = 30","ubuntu_linux = 12.04","ubuntu_linux = 14.04","ubuntu_linux = 16.04","ubuntu_linux = 18.04","ansible_tower = 3.3","enterprise_linux_desktop = 7.0","enterprise_linux_server = 7.0","enterprise_linux_workstation = 7.0","debian_linux = 8.0","debian_linux = 9.0"],"patched":["python 3.6.5"],"published":"2018-06-18","updated":"2026-10-08","sourceUpdated":"2026-10-08T21:17:08.940","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2018-1060","references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","label":"secalert@redhat.com"},{"url":"http://www.securitytracker.com/id/1042001","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHBA-2019:0327","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2018:3041","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2018:3505","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2019:1260","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2019:3725","label":"secalert@redhat.com"},{"url":"https://bugs.python.org/issue32981","label":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1060","label":"secalert@redhat.com"},{"url":"https://docs.python.org/3.5/whatsnew/changelog.html#python-3-5-6-release-candidate-1","label":"secalert@redhat.com"},{"url":"https://docs.python.org/3.6/whatsnew/changelog.html#python-3-6-5-release-candidate-1","label":"secalert@redhat.com"},{"url":"https://lists.debian.org/debian-lts-announce/2018/09/msg00030.html","label":"secalert@redhat.com"},{"url":"https://lists.debian.org/debian-lts-announce/2018/09/msg00031.html","label":"secalert@redhat.com"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46PVWY5LFP4BRPG3BVQ5QEEFYBVEXHCK/","label":"secalert@redhat.com"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AEZ5IQT7OF7Q2NCGIVABOWYGKO7YU3NJ/","label":"secalert@redhat.com"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JSKPGPZQNTAULHW4UH63KGOOUIDE4RRB/","label":"secalert@redhat.com"},{"url":"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03951en_us","label":"secalert@redhat.com"},{"url":"https://usn.ubuntu.com/3817-1/","label":"secalert@redhat.com"},{"url":"https://usn.ubuntu.com/3817-2/","label":"secalert@redhat.com"},{"url":"https://www.debian.org/security/2018/dsa-4306","label":"secalert@redhat.com"},{"url":"https://www.debian.org/security/2018/dsa-4307","label":"secalert@redhat.com"},{"url":"https://www.oracle.com/security-alerts/cpujan2020.html","label":"secalert@redhat.com"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securitytracker.com/id/1042001","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHBA-2019:0327","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2018:3041","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2018:3505","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2019:1260","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2019:3725","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://bugs.python.org/issue32981","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1060","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://docs.python.org/3.5/whatsnew/changelog.html#python-3-5-6-release-candidate-1","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://docs.python.org/3.6/whatsnew/changelog.html#python-3-6-5-release-candidate-1","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2018/09/msg00030.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2018/09/msg00031.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46PVWY5LFP4BRPG3BVQ5QEEFYBVEXHCK/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AEZ5IQT7OF7Q2NCGIVABOWYGKO7YU3NJ/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JSKPGPZQNTAULHW4UH63KGOOUIDE4RRB/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03951en_us","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://usn.ubuntu.com/3817-1/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://usn.ubuntu.com/3817-2/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.debian.org/security/2018/dsa-4306","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.debian.org/security/2018/dsa-4307","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpujan2020.html","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd"],"epss":0.05039,"epssPercentile":0.92061,"ingestedAt":"2026-10-08T22:11:53.693Z","slug":"CVE-2018-1060","body":"## Overview\n\npython before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib's apop() method. An attacker could use this flaw to cause denial of service.\n\n## Affected\n\n- `python >= 2.7.0, < 2.7.15`\n- `python >= 3.0.0, < 3.4.9`\n- `python >= 3.5.0, < 3.5.6`\n- `python > 3.6.0, < 3.6.5`\n- `fedora = 28`\n- `fedora = 29`\n- `fedora = 30`\n- `ubuntu_linux = 12.04`\n- `ubuntu_linux = 14.04`\n- `ubuntu_linux = 16.04`\n- `ubuntu_linux = 18.04`\n- `ansible_tower = 3.3`\n- `enterprise_linux_desktop = 7.0`\n- `enterprise_linux_server = 7.0`\n- `enterprise_linux_workstation = 7.0`\n- `debian_linux = 8.0`\n- `debian_linux = 9.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `python 3.6.5`","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":41.3,"likelihood":1,"exploitation":0,"ransomware":0},"changes":[]}