CVE-2018-1061
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.5epss 5.0%
exploitation probability
5.0%top 9% of all CVEs
observed exploitation
nono source reports it
python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in the difflib.IS_LINE_JUNK method. An attacker could use this flaw to cause denial of service.
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected products
[UNKNOWN] · pythonReferences
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.htmlhttps://access.redhat.com/errata/RHBA-2019:0327https://access.redhat.com/errata/RHSA-2018:3041https://access.redhat.com/errata/RHSA-2018:3505https://access.redhat.com/errata/RHSA-2019:1260https://access.redhat.com/errata/RHSA-2019:3725https://bugs.python.org/issue32981https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1061https://docs.python.org/3.5/whatsnew/changelog.html#python-3-5-6-release-candidate-1https://docs.python.org/3.6/whatsnew/changelog.html#python-3-6-5-release-candidate-1https://lists.debian.org/debian-lts-announce/2018/09/msg00030.htmlhttps://lists.debian.org/debian-lts-announce/2018/09/msg00031.html