CVE-2018-1060High· 7.5▾ Twilightpython before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib's apop() method. An attacker could use this flaw to cause denial of service.
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
5.0%
python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib's apop() method. An attacker could use this flaw to cause denial of service.
python >= 2.7.0, < 2.7.15python >= 3.0.0, < 3.4.9python >= 3.5.0, < 3.5.6python > 3.6.0, < 3.6.5fedora = 28fedora = 29fedora = 30ubuntu_linux = 12.04ubuntu_linux = 14.04ubuntu_linux = 16.04ubuntu_linux = 18.04ansible_tower = 3.3enterprise_linux_desktop = 7.0enterprise_linux_server = 7.0enterprise_linux_workstation = 7.0debian_linux = 8.0debian_linux = 9.0Upgrade past the affected range:
python 3.6.5Connected by shared product, vendor, weakness, or advisory.
CVE-2019-16056High· 7.5An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4
CVE-2018-20852Medium· 4.3http.cookiejar.DefaultPolicy.domain_return_ok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly validate the domain: it can be tricked into sending existing cookies to the wrong server
CVE-2018-1000802Critical· 9.8Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in shutil module (make_archive function) that can result in Deni…
CVE-2017-1000158Critical· 9.8CPython (aka Python) up to 2.7.13 is vulnerable to an integer overflow in the PyString_DecodeEscape function in stringobject.c, resulting in heap-based buffer overflow (and possible arbitrary code execution)
CVE-2018-1000030Low· 3.6Python 2.7.14 is vulnerable to a Heap-Buffer-Overflow as well as a Heap-Use-After-Free
CVE-2019-5010High· 7.5An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6