CVE-2018-1060

NameCVE-2018-1060
Descriptionpython before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib's apop() method. An attacker could use this flaw to cause denial of service.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)
ReferencesDLA-1519-1, DLA-1520-1, DSA-4306-1, DSA-4307-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
python2.7 (PTS)buster2.7.16-2+deb10u1fixed
bullseye2.7.18-8fixed
bookworm, sid2.7.18-13.2fixed
python3.7 (PTS)buster3.7.3-2+deb10u3fixed
buster (security)3.7.3-2+deb10u4fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
python2.6source(unstable)(unfixed)low
python2.7sourcejessie2.7.9-2+deb8u2DLA-1519-1
python2.7sourcestretch2.7.13-2+deb9u3DSA-4306-1
python2.7source(unstable)2.7.14-7low
python3.2source(unstable)(unfixed)low
python3.4sourcejessie3.4.2-1+deb8u1DLA-1520-1
python3.4source(unstable)(unfixed)low
python3.5sourcestretch3.5.3-1+deb9u1DSA-4307-1
python3.5source(unstable)3.5.6-1low
python3.6source(unstable)3.6.5~rc1-1low
python3.7source(unstable)3.7.0~b3-1low

Notes

[wheezy] - python3.2 <no-dsa> (Minor issue)
[wheezy] - python2.7 <no-dsa> (Minor issue)
[wheezy] - python2.6 <no-dsa> (Minor issue)
https://bugs.python.org/issue32981
https://github.com/python/cpython/commit/0e6c8ee2358a2e23117501826c008842acb835ac (master)
https://github.com/python/cpython/commit/0902a2d6b2d1d9dbde36aeaaccf1788ceaa97143 (3.7)
https://github.com/python/cpython/commit/c9516754067d71fd7429a25ccfcb2141fc583523 (3.6)
https://github.com/python/cpython/commit/937ac1fe069a4dc8471dff205f553d82e724015b (3.5)
https://github.com/python/cpython/commit/942cc04ae44825ea120e3a19a80c9b348b8194d0 (3.4)
https://github.com/python/cpython/commit/e052d40cea15f582b50947f7d906b39744dc62a2 (2.7)

Search for package or bug name: Reporting problems