CVE-2018-14647 : Python's elementtree C accelerator failed to initialise Expat's hash salt during

Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming large amounts CPU and RAM. The vulnerability exists in Python versions 3.7.0, 3.6.0 through 3.6.6, 3.5.0 through 3.5.6, 3.4.0 through 3.4.9, 2.7.0 through 2.7.15.

Published 2018-09-25 00:29:01

Updated 2020-07-29 12:15:15

Source Red Hat, Inc.

View at NVD, CVE.org

Vulnerability category: Denial of service

Products affected by CVE-2018-14647

Debian » Debian Linux » Version: 8.0
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
Matching versions
Debian » Debian Linux » Version: 9.0
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux Desktop » Version: 7.0
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux Server » Version: 7.0
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux Workstation » Version: 7.0
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 14.04 ESM Edition
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 12.04 ESM Edition
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 16.04 LTS Edition
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 18.04 LTS Edition
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
Matching versions
Fedoraproject » Fedora » Version: 30
cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*
Matching versions
Opensuse » Leap » Version: 15.1
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
Matching versions
Python » Python
Versions from including (>=) 3.6.0 and up to, including, (<=) 3.6.6
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
Matching versions
Python » Python
Versions from including (>=) 3.4.0 and up to, including, (<=) 3.4.9
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
Matching versions
Python » Python
Versions from including (>=) 3.5.0 and up to, including, (<=) 3.5.6
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
Matching versions
Python » Python
Versions from including (>=) 2.7.0 and up to, including, (<=) 2.7.15
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
Matching versions
Python » Python » Version: 3.7.0
cpe:2.3:a:python:python:3.7.0:*:*:*:*:*:*:*
Matching versions

Threat overview for CVE-2018-14647

Top countries where our scanners detected CVE-2018-14647

Top open port discovered on systems with this issue 80

IPs affected by CVE-2018-14647 82,100

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2018-14647!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2018-14647

EPSS FAQ

0.52%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 77 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2018-14647

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:N/I:N/A:P	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Partial
5.3	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L	3.9	1.4	Red Hat, Inc.
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: Low
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High

CWE ids for CVE-2018-14647

CWE-335 Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)

The product uses a Pseudo-Random Number Generator (PRNG) but does not correctly manage seeds.

Assigned by: secalert@redhat.com (Secondary)
CWE-665 Improper Initialization

The product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.

Assigned by: secalert@redhat.com (Secondary)
CWE-909 Missing Initialization of Resource

The product does not initialize a critical resource.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2018-14647

https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3E

[GitHub] [bookkeeper] padma81 opened a new issue #2387: Security vulnerabilities in the apache/bookkeeper-4.9.2 image - Pony Mail

CVEs referencing this url
https://access.redhat.com/errata/RHSA-2019:3725

RHSA-2019:3725 - Security Advisory - Red Hat Customer Portal
Third Party Advisory

CVEs referencing this url
https://lists.debian.org/debian-lts-announce/2019/06/msg00023.html

[SECURITY] [DLA 1835-1] python3.4 security update
Mailing List;Third Party Advisory

CVEs referencing this url
https://usn.ubuntu.com/3817-2/

USN-3817-2: Python vulnerabilities | Ubuntu security notices
Third Party Advisory

CVEs referencing this url
https://www.debian.org/security/2018/dsa-4307

Debian -- Security Information -- DSA-4307-1 python3.5
Third Party Advisory

CVEs referencing this url
http://www.securityfocus.com/bid/105396

Python CVE-2018-14647 Remote Denial of Service Vulnerability
Third Party Advisory;VDB Entry
https://access.redhat.com/errata/RHSA-2019:2030

RHSA-2019:2030 - Security Advisory - Red Hat Customer Portal
Third Party Advisory

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html

[security-announce] openSUSE-SU-2020:0086-1: important: Security update
Mailing List;Third Party Advisory

CVEs referencing this url
https://access.redhat.com/errata/RHSA-2019:1260

RHSA-2019:1260 - Security Advisory - Red Hat Customer Portal
Third Party Advisory

CVEs referencing this url
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RBJCB2HWOJLP3L7CUQHJHNBHLSVOXJE5/

[SECURITY] Fedora 30 Update: python2-2.7.16-1.fc30 - package-announce - Fedora Mailing-Lists
Third Party Advisory
https://bugs.python.org/issue34623

Issue 34623: _elementtree.c doesn't call XML_SetHashSalt() - Python tracker
Issue Tracking;Patch;Vendor Advisory
https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html

[SECURITY] [DLA 1834-1] python2.7 security update
Mailing List;Third Party Advisory

CVEs referencing this url
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14647

1631822 – (CVE-2018-14647) CVE-2018-14647 python: Missing salt initialization in _elementtree.c module
Issue Tracking;Third Party Advisory
http://www.securitytracker.com/id/1041740

Python elementtree C Accelerator Lets Remote Users Consume Excessive CPU and Memory Resources - SecurityTracker
Third Party Advisory;VDB Entry
https://usn.ubuntu.com/3817-1/

USN-3817-1: Python vulnerabilities | Ubuntu security notices
Third Party Advisory

CVEs referencing this url
https://www.debian.org/security/2018/dsa-4306

Debian -- Security Information -- DSA-4306-1 python2.7
Third Party Advisory

CVEs referencing this url