CVE-2018-20406

NameCVE-2018-20406
DescriptionModules/_pickle.c in Python before 3.7.1 has an integer overflow via a large LONG_BINPUT value that is mishandled during a "resize to twice the size" attempt. This issue might cause memory exhaustion, but is only relevant if the pickle format is used for serializing tens or hundreds of gigabytes of data.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-1663-1
NVD severitymedium (attack range: remote)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
python3.4 (PTS)jessie3.4.2-1vulnerable
jessie (security)3.4.2-1+deb8u2fixed
python3.5 (PTS)stretch (security), stretch3.5.3-1+deb9u1vulnerable
python3.7 (PTS)buster3.7.3~rc1-1fixed
sid3.7.3-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
python3.4source(unstable)(unfixed)unimportant
python3.4sourcejessie3.4.2-1+deb8u2mediumDLA-1663-1
python3.5source(unstable)(unfixed)unimportant
python3.6source(unstable)3.6.7~rc1-1unimportant
python3.7source(unstable)3.7.0-7unimportant

Notes

https://bugs.python.org/issue34656
https://github.com/python/cpython/commit/a4ae828ee416a66d8c7bf5ee71d653c2cc6a26dd (master)
https://github.com/python/cpython/commit/ef4306b24c9034d6b37bb034e2ebe82e745d4b77 (3.7)
https://github.com/python/cpython/commit/71a9c65e74a70b6ed39adc4ba81d311ac1aa2acc (3.6)
Negligible security impact

Search for package or bug name: Reporting problems