--- id: CVE-2018-1060 title: >- python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib's apop() method summary: >- python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib's apop() method. An attacker could use this flaw to cause denial of service. severity: high cvss: 7.5 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H' cwe: - CWE-20 vendor: python product: python affected: - 'python >= 2.7.0, < 2.7.15' - 'python >= 3.0.0, < 3.4.9' - 'python >= 3.5.0, < 3.5.6' - 'python > 3.6.0, < 3.6.5' - fedora = 28 - fedora = 29 - fedora = 30 - ubuntu_linux = 12.04 - ubuntu_linux = 14.04 - ubuntu_linux = 16.04 - ubuntu_linux = 18.04 - ansible_tower = 3.3 - enterprise_linux_desktop = 7.0 - enterprise_linux_server = 7.0 - enterprise_linux_workstation = 7.0 - debian_linux = 8.0 - debian_linux = 9.0 patched: - python 3.6.5 published: '2018-06-18' updated: '2026-10-08' sourceUpdated: '2026-10-08T21:17:08.940' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2018-1060' references: - url: 'http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html' label: secalert@redhat.com - url: 'http://www.securitytracker.com/id/1042001' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHBA-2019:0327' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2018:3041' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2018:3505' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2019:1260' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2019:3725' label: secalert@redhat.com - url: 'https://bugs.python.org/issue32981' label: secalert@redhat.com - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1060' label: secalert@redhat.com - url: >- https://docs.python.org/3.5/whatsnew/changelog.html#python-3-5-6-release-candidate-1 label: secalert@redhat.com - url: >- https://docs.python.org/3.6/whatsnew/changelog.html#python-3-6-5-release-candidate-1 label: secalert@redhat.com - url: 'https://lists.debian.org/debian-lts-announce/2018/09/msg00030.html' label: secalert@redhat.com - url: 'https://lists.debian.org/debian-lts-announce/2018/09/msg00031.html' label: secalert@redhat.com - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46PVWY5LFP4BRPG3BVQ5QEEFYBVEXHCK/ label: secalert@redhat.com - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AEZ5IQT7OF7Q2NCGIVABOWYGKO7YU3NJ/ label: secalert@redhat.com - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JSKPGPZQNTAULHW4UH63KGOOUIDE4RRB/ label: secalert@redhat.com - url: >- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03951en_us label: secalert@redhat.com - url: 'https://usn.ubuntu.com/3817-1/' label: secalert@redhat.com - url: 'https://usn.ubuntu.com/3817-2/' label: secalert@redhat.com - url: 'https://www.debian.org/security/2018/dsa-4306' label: secalert@redhat.com - url: 'https://www.debian.org/security/2018/dsa-4307' label: secalert@redhat.com - url: 'https://www.oracle.com/security-alerts/cpujan2020.html' label: secalert@redhat.com - url: 'http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://www.securitytracker.com/id/1042001' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHBA-2019:0327' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2018:3041' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2018:3505' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2019:1260' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2019:3725' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://bugs.python.org/issue32981' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1060' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://docs.python.org/3.5/whatsnew/changelog.html#python-3-5-6-release-candidate-1 label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://docs.python.org/3.6/whatsnew/changelog.html#python-3-6-5-release-candidate-1 label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://lists.debian.org/debian-lts-announce/2018/09/msg00030.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://lists.debian.org/debian-lts-announce/2018/09/msg00031.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46PVWY5LFP4BRPG3BVQ5QEEFYBVEXHCK/ label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AEZ5IQT7OF7Q2NCGIVABOWYGKO7YU3NJ/ label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JSKPGPZQNTAULHW4UH63KGOOUIDE4RRB/ label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03951en_us label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://usn.ubuntu.com/3817-1/' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://usn.ubuntu.com/3817-2/' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.debian.org/security/2018/dsa-4306' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.debian.org/security/2018/dsa-4307' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpujan2020.html' label: af854a3a-2127-422b-91ae-364da2661108 tags: - nvd epss: 0.05039 epssPercentile: 0.92061 ingestedAt: '2026-10-08T22:11:53.693Z' --- ## Overview python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib's apop() method. An attacker could use this flaw to cause denial of service. ## Affected - `python >= 2.7.0, < 2.7.15` - `python >= 3.0.0, < 3.4.9` - `python >= 3.5.0, < 3.5.6` - `python > 3.6.0, < 3.6.5` - `fedora = 28` - `fedora = 29` - `fedora = 30` - `ubuntu_linux = 12.04` - `ubuntu_linux = 14.04` - `ubuntu_linux = 16.04` - `ubuntu_linux = 18.04` - `ansible_tower = 3.3` - `enterprise_linux_desktop = 7.0` - `enterprise_linux_server = 7.0` - `enterprise_linux_workstation = 7.0` - `debian_linux = 8.0` - `debian_linux = 9.0` ## Remediation Upgrade past the affected range: - `python 3.6.5`