What’s Vulnerable › Vulnerabilities

CVE-2018-1060

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 5.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2018-06-18 · updated 2026-10-08
• Weakness: CWE-20

Description

python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib's apop() method. An attacker could use this flaw to cause denial of service.

Affected products

• Canonical Ubuntu Linux: 12.04, 14.04, 16.04, 18.04
• Debian Linux: 8.0, 9.0
• Fedoraproject Fedora: 28, 29, 30
• Python: from 2.7.0 before 2.7.15; from 3.0.0 before 3.4.9; from 3.5.0 before 3.5.6; from 3.6.0 (excl.) before 3.6.5 — fixed in 2.7.15, 3.4.9, 3.5.6, 3.6.5
• Tower: 3.3
• RedHat Enterprise Linux Desktop: 7.0
• RedHat Enterprise Linux Server: 7.0
• RedHat Enterprise Linux Workstation: 7.0

How to fix

Upgrade to a fixed version: Python 2.7.15, 3.4.9, 3.5.6, 3.6.5. Check the vendor advisory for mitigations.

References

• http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html
• http://www.securitytracker.com/id/1042001
• https://access.redhat.com/errata/RHBA-2019:0327
• https://access.redhat.com/errata/RHSA-2018:3041
• https://access.redhat.com/errata/RHSA-2018:3505
• https://access.redhat.com/errata/RHSA-2019:1260
• https://access.redhat.com/errata/RHSA-2019:3725
• https://bugs.python.org/issue32981
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1060
• https://docs.python.org/3.5/whatsnew/changelog.html#python-3-5-6-release-candidate-1
• https://docs.python.org/3.6/whatsnew/changelog.html#python-3-6-5-release-candidate-1
• https://lists.debian.org/debian-lts-announce/2018/09/msg00030.html

Get alerted when CVE-2018-1060 or the next vulnerability affects your stack