CVE-2018-20406

NameCVE-2018-20406
DescriptionModules/_pickle.c in Python before 3.7.1 has an integer overflow via a large LONG_BINPUT value that is mishandled during a "resize to twice the size" attempt. This issue might cause memory exhaustion, but is only relevant if the pickle format is used for serializing tens or hundreds of gigabytes of data.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-1663-1
NVD severitymedium (attack range: remote)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
python3.4 (PTS)jessie3.4.2-1vulnerable
jessie (security)3.4.2-1+deb8u2fixed
python3.5 (PTS)stretch (security), stretch3.5.3-1+deb9u1vulnerable
python3.6 (PTS)sid3.6.8-1fixed
python3.7 (PTS)buster, sid3.7.3~rc1-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
python3.4source(unstable)(unfixed)medium
python3.4sourcejessie3.4.2-1+deb8u2mediumDLA-1663-1
python3.5source(unstable)(unfixed)medium
python3.6source(unstable)3.6.7~rc1-1medium
python3.7source(unstable)3.7.0-7medium

Notes

[stretch] - python3.5 <no-dsa> (Minor issue)
https://bugs.python.org/issue34656
https://github.com/python/cpython/commit/a4ae828ee416a66d8c7bf5ee71d653c2cc6a26dd (master)
https://github.com/python/cpython/commit/ef4306b24c9034d6b37bb034e2ebe82e745d4b77 (3.7)
https://github.com/python/cpython/commit/71a9c65e74a70b6ed39adc4ba81d311ac1aa2acc (3.6)

Search for package or bug name: Reporting problems