UBUNTU-CVE-2018-14647

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2018-14647
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2018/UBUNTU-CVE-2018-14647.json
JSON Data
https://api.test.osv.dev/v1/vulns/UBUNTU-CVE-2018-14647
Upstream
Downstream
Related
Published
2018-09-24T00:00:00Z
Modified
2025-09-08T16:44:59Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
  • 5.3 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
  • 7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
  • Ubuntu - medium
Summary
[none]
Details

Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming large amounts CPU and RAM. The vulnerability exists in Python versions 3.7.0, 3.6.0 through 3.6.6, 3.5.0 through 3.5.6, 3.4.0 through 3.4.9, 2.7.0 through 2.7.15.

References

Affected packages

Ubuntu:14.04:LTS

python2.7

Package

Name
python2.7
Purl
pkg:deb/ubuntu/python2.7@2.7.6-8ubuntu0.5?arch=source&distro=trusty

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.7.6-8ubuntu0.5

Affected versions

2.*

2.7.5-8ubuntu3
2.7.5-8ubuntu4
2.7.6-2
2.7.6-2ubuntu1
2.7.6-3
2.7.6-3ubuntu1
2.7.6-4
2.7.6-4ubuntu1
2.7.6-5
2.7.6-7
2.7.6-8
2.7.6-8ubuntu0.2
2.7.6-8ubuntu0.3
2.7.6-8ubuntu0.4

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "idle-python2.7",
            "binary_version": "2.7.6-8ubuntu0.5"
        },
        {
            "binary_name": "libpython2.7",
            "binary_version": "2.7.6-8ubuntu0.5"
        },
        {
            "binary_name": "libpython2.7-dev",
            "binary_version": "2.7.6-8ubuntu0.5"
        },
        {
            "binary_name": "libpython2.7-minimal",
            "binary_version": "2.7.6-8ubuntu0.5"
        },
        {
            "binary_name": "libpython2.7-stdlib",
            "binary_version": "2.7.6-8ubuntu0.5"
        },
        {
            "binary_name": "libpython2.7-testsuite",
            "binary_version": "2.7.6-8ubuntu0.5"
        },
        {
            "binary_name": "python2.7",
            "binary_version": "2.7.6-8ubuntu0.5"
        },
        {
            "binary_name": "python2.7-dev",
            "binary_version": "2.7.6-8ubuntu0.5"
        },
        {
            "binary_name": "python2.7-examples",
            "binary_version": "2.7.6-8ubuntu0.5"
        },
        {
            "binary_name": "python2.7-minimal",
            "binary_version": "2.7.6-8ubuntu0.5"
        }
    ],
    "availability": "No subscription required"
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2018/UBUNTU-CVE-2018-14647.json"

python3.4

Package

Name
python3.4
Purl
pkg:deb/ubuntu/python3.4@3.4.3-1ubuntu1~14.04.7?arch=source&distro=trusty

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.4.3-1ubuntu1~14.04.7

Affected versions

3.*

3.4~b1-0ubuntu3
3.4~b1-4ubuntu4
3.4~b1-4ubuntu6
3.4~b1-5ubuntu2
3.4~b2-1
3.4~b3-1ubuntu1
3.4~rc1-1build1
3.4~rc2-1
3.4~rc3-0ubuntu1
3.4.0-1
3.4.0-2ubuntu1
3.4.0-2ubuntu1.1
3.4.3-1ubuntu1~14.04.1
3.4.3-1ubuntu1~14.04.3
3.4.3-1ubuntu1~14.04.4
3.4.3-1ubuntu1~14.04.5
3.4.3-1ubuntu1~14.04.6

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "idle-python3.4",
            "binary_version": "3.4.3-1ubuntu1~14.04.7"
        },
        {
            "binary_name": "libpython3.4",
            "binary_version": "3.4.3-1ubuntu1~14.04.7"
        },
        {
            "binary_name": "libpython3.4-dev",
            "binary_version": "3.4.3-1ubuntu1~14.04.7"
        },
        {
            "binary_name": "libpython3.4-minimal",
            "binary_version": "3.4.3-1ubuntu1~14.04.7"
        },
        {
            "binary_name": "libpython3.4-stdlib",
            "binary_version": "3.4.3-1ubuntu1~14.04.7"
        },
        {
            "binary_name": "libpython3.4-testsuite",
            "binary_version": "3.4.3-1ubuntu1~14.04.7"
        },
        {
            "binary_name": "python3.4",
            "binary_version": "3.4.3-1ubuntu1~14.04.7"
        },
        {
            "binary_name": "python3.4-dev",
            "binary_version": "3.4.3-1ubuntu1~14.04.7"
        },
        {
            "binary_name": "python3.4-examples",
            "binary_version": "3.4.3-1ubuntu1~14.04.7"
        },
        {
            "binary_name": "python3.4-minimal",
            "binary_version": "3.4.3-1ubuntu1~14.04.7"
        },
        {
            "binary_name": "python3.4-venv",
            "binary_version": "3.4.3-1ubuntu1~14.04.7"
        }
    ],
    "availability": "No subscription required"
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2018/UBUNTU-CVE-2018-14647.json"

Ubuntu:16.04:LTS

python2.7

Package

Name
python2.7
Purl
pkg:deb/ubuntu/python2.7@2.7.12-1ubuntu0~16.04.4?arch=source&distro=xenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.7.12-1ubuntu0~16.04.4

Affected versions

2.*

2.7.10-4ubuntu1
2.7.10-4ubuntu2
2.7.11-2
2.7.11-3
2.7.11-4
2.7.11-6
2.7.11-7
2.7.11-7ubuntu1
2.7.12-1~16.04
2.7.12-1ubuntu0~16.04.1
2.7.12-1ubuntu0~16.04.2
2.7.12-1ubuntu0~16.04.3

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "idle-python2.7",
            "binary_version": "2.7.12-1ubuntu0~16.04.4"
        },
        {
            "binary_name": "libpython2.7",
            "binary_version": "2.7.12-1ubuntu0~16.04.4"
        },
        {
            "binary_name": "libpython2.7-dev",
            "binary_version": "2.7.12-1ubuntu0~16.04.4"
        },
        {
            "binary_name": "libpython2.7-minimal",
            "binary_version": "2.7.12-1ubuntu0~16.04.4"
        },
        {
            "binary_name": "libpython2.7-stdlib",
            "binary_version": "2.7.12-1ubuntu0~16.04.4"
        },
        {
            "binary_name": "libpython2.7-testsuite",
            "binary_version": "2.7.12-1ubuntu0~16.04.4"
        },
        {
            "binary_name": "python2.7",
            "binary_version": "2.7.12-1ubuntu0~16.04.4"
        },
        {
            "binary_name": "python2.7-dev",
            "binary_version": "2.7.12-1ubuntu0~16.04.4"
        },
        {
            "binary_name": "python2.7-examples",
            "binary_version": "2.7.12-1ubuntu0~16.04.4"
        },
        {
            "binary_name": "python2.7-minimal",
            "binary_version": "2.7.12-1ubuntu0~16.04.4"
        }
    ],
    "availability": "No subscription required"
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2018/UBUNTU-CVE-2018-14647.json"

python3.5

Package

Name
python3.5
Purl
pkg:deb/ubuntu/python3.5@3.5.2-2ubuntu0~16.04.5?arch=source&distro=xenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.5.2-2ubuntu0~16.04.5

Affected versions

3.*

3.5.0-3
3.5.0-3ubuntu1
3.5.1~rc1-2ubuntu1
3.5.1-1
3.5.1-2
3.5.1-3
3.5.1-5
3.5.1-6ubuntu1
3.5.1-6ubuntu2
3.5.1-9ubuntu1
3.5.1-10
3.5.2-2~16.01
3.5.2-2~16.04
3.5.2-2ubuntu0~16.04.1
3.5.2-2ubuntu0~16.04.2
3.5.2-2ubuntu0~16.04.3
3.5.2-2ubuntu0~16.04.4

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "idle-python3.5",
            "binary_version": "3.5.2-2ubuntu0~16.04.5"
        },
        {
            "binary_name": "libpython3.5",
            "binary_version": "3.5.2-2ubuntu0~16.04.5"
        },
        {
            "binary_name": "libpython3.5-dev",
            "binary_version": "3.5.2-2ubuntu0~16.04.5"
        },
        {
            "binary_name": "libpython3.5-minimal",
            "binary_version": "3.5.2-2ubuntu0~16.04.5"
        },
        {
            "binary_name": "libpython3.5-stdlib",
            "binary_version": "3.5.2-2ubuntu0~16.04.5"
        },
        {
            "binary_name": "libpython3.5-testsuite",
            "binary_version": "3.5.2-2ubuntu0~16.04.5"
        },
        {
            "binary_name": "python3.5",
            "binary_version": "3.5.2-2ubuntu0~16.04.5"
        },
        {
            "binary_name": "python3.5-dev",
            "binary_version": "3.5.2-2ubuntu0~16.04.5"
        },
        {
            "binary_name": "python3.5-examples",
            "binary_version": "3.5.2-2ubuntu0~16.04.5"
        },
        {
            "binary_name": "python3.5-minimal",
            "binary_version": "3.5.2-2ubuntu0~16.04.5"
        },
        {
            "binary_name": "python3.5-venv",
            "binary_version": "3.5.2-2ubuntu0~16.04.5"
        }
    ],
    "availability": "No subscription required"
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2018/UBUNTU-CVE-2018-14647.json"

Ubuntu:18.04:LTS

python2.7

Package

Name
python2.7
Purl
pkg:deb/ubuntu/python2.7@2.7.15~rc1-1ubuntu0.1?arch=source&distro=bionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.7.15~rc1-1ubuntu0.1

Affected versions

2.*

2.7.14-2ubuntu2
2.7.14-4
2.7.14-6
2.7.14-7
2.7.14-8
2.7.15~rc1-1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "idle-python2.7",
            "binary_version": "2.7.15~rc1-1ubuntu0.1"
        },
        {
            "binary_name": "libpython2.7",
            "binary_version": "2.7.15~rc1-1ubuntu0.1"
        },
        {
            "binary_name": "libpython2.7-dev",
            "binary_version": "2.7.15~rc1-1ubuntu0.1"
        },
        {
            "binary_name": "libpython2.7-minimal",
            "binary_version": "2.7.15~rc1-1ubuntu0.1"
        },
        {
            "binary_name": "libpython2.7-stdlib",
            "binary_version": "2.7.15~rc1-1ubuntu0.1"
        },
        {
            "binary_name": "libpython2.7-testsuite",
            "binary_version": "2.7.15~rc1-1ubuntu0.1"
        },
        {
            "binary_name": "python2.7",
            "binary_version": "2.7.15~rc1-1ubuntu0.1"
        },
        {
            "binary_name": "python2.7-dev",
            "binary_version": "2.7.15~rc1-1ubuntu0.1"
        },
        {
            "binary_name": "python2.7-examples",
            "binary_version": "2.7.15~rc1-1ubuntu0.1"
        },
        {
            "binary_name": "python2.7-minimal",
            "binary_version": "2.7.15~rc1-1ubuntu0.1"
        }
    ],
    "availability": "No subscription required"
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2018/UBUNTU-CVE-2018-14647.json"

python3.6

Package

Name
python3.6
Purl
pkg:deb/ubuntu/python3.6@3.6.7-1~18.04?arch=source&distro=bionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.6.7-1~18.04

Affected versions

3.*

3.6.3-1ubuntu1
3.6.4~rc1-1
3.6.4~rc1-2
3.6.4-1
3.6.4-2
3.6.4-3build1
3.6.4-4
3.6.5~rc1-1
3.6.5-3
3.6.6-1~18.04

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "idle-python3.6",
            "binary_version": "3.6.7-1~18.04"
        },
        {
            "binary_name": "libpython3.6",
            "binary_version": "3.6.7-1~18.04"
        },
        {
            "binary_name": "libpython3.6-dev",
            "binary_version": "3.6.7-1~18.04"
        },
        {
            "binary_name": "libpython3.6-minimal",
            "binary_version": "3.6.7-1~18.04"
        },
        {
            "binary_name": "libpython3.6-stdlib",
            "binary_version": "3.6.7-1~18.04"
        },
        {
            "binary_name": "libpython3.6-testsuite",
            "binary_version": "3.6.7-1~18.04"
        },
        {
            "binary_name": "python3.6",
            "binary_version": "3.6.7-1~18.04"
        },
        {
            "binary_name": "python3.6-dev",
            "binary_version": "3.6.7-1~18.04"
        },
        {
            "binary_name": "python3.6-examples",
            "binary_version": "3.6.7-1~18.04"
        },
        {
            "binary_name": "python3.6-minimal",
            "binary_version": "3.6.7-1~18.04"
        },
        {
            "binary_name": "python3.6-venv",
            "binary_version": "3.6.7-1~18.04"
        }
    ],
    "availability": "No subscription required"
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2018/UBUNTU-CVE-2018-14647.json"

python3.7

Package

Name
python3.7
Purl
pkg:deb/ubuntu/python3.7@3.7.1-1~18.04?arch=source&distro=bionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.7.1-1~18.04

Affected versions

3.*

3.7.0~a2-1
3.7.0~a3-1
3.7.0~a3-2
3.7.0~a3-3
3.7.0~a4-1
3.7.0~b1-1
3.7.0~b1-1build1
3.7.0~b2-1
3.7.0~b3-1
3.7.0-1~18.04

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "idle-python3.7",
            "binary_version": "3.7.1-1~18.04"
        },
        {
            "binary_name": "libpython3.7",
            "binary_version": "3.7.1-1~18.04"
        },
        {
            "binary_name": "libpython3.7-dev",
            "binary_version": "3.7.1-1~18.04"
        },
        {
            "binary_name": "libpython3.7-minimal",
            "binary_version": "3.7.1-1~18.04"
        },
        {
            "binary_name": "libpython3.7-stdlib",
            "binary_version": "3.7.1-1~18.04"
        },
        {
            "binary_name": "libpython3.7-testsuite",
            "binary_version": "3.7.1-1~18.04"
        },
        {
            "binary_name": "python3.7",
            "binary_version": "3.7.1-1~18.04"
        },
        {
            "binary_name": "python3.7-dev",
            "binary_version": "3.7.1-1~18.04"
        },
        {
            "binary_name": "python3.7-examples",
            "binary_version": "3.7.1-1~18.04"
        },
        {
            "binary_name": "python3.7-minimal",
            "binary_version": "3.7.1-1~18.04"
        },
        {
            "binary_name": "python3.7-venv",
            "binary_version": "3.7.1-1~18.04"
        }
    ],
    "availability": "No subscription required"
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2018/UBUNTU-CVE-2018-14647.json"

Ubuntu:Pro:14.04:LTS

python3.5

Package

Name
python3.5
Purl
pkg:deb/ubuntu/python3.5@3.5.2-2ubuntu0~16.04.4~14.04.1+esm1?arch=source&distro=trusty/esm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.5.2-2ubuntu0~16.04.4~14.04.1+esm1

Affected versions

3.*

3.5.2-2ubuntu0~16.04.4~14.04.1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "idle-python3.5",
            "binary_version": "3.5.2-2ubuntu0~16.04.4~14.04.1+esm1"
        },
        {
            "binary_name": "libpython3.5",
            "binary_version": "3.5.2-2ubuntu0~16.04.4~14.04.1+esm1"
        },
        {
            "binary_name": "libpython3.5-dev",
            "binary_version": "3.5.2-2ubuntu0~16.04.4~14.04.1+esm1"
        },
        {
            "binary_name": "libpython3.5-minimal",
            "binary_version": "3.5.2-2ubuntu0~16.04.4~14.04.1+esm1"
        },
        {
            "binary_name": "libpython3.5-stdlib",
            "binary_version": "3.5.2-2ubuntu0~16.04.4~14.04.1+esm1"
        },
        {
            "binary_name": "libpython3.5-testsuite",
            "binary_version": "3.5.2-2ubuntu0~16.04.4~14.04.1+esm1"
        },
        {
            "binary_name": "python3.5",
            "binary_version": "3.5.2-2ubuntu0~16.04.4~14.04.1+esm1"
        },
        {
            "binary_name": "python3.5-dev",
            "binary_version": "3.5.2-2ubuntu0~16.04.4~14.04.1+esm1"
        },
        {
            "binary_name": "python3.5-examples",
            "binary_version": "3.5.2-2ubuntu0~16.04.4~14.04.1+esm1"
        },
        {
            "binary_name": "python3.5-minimal",
            "binary_version": "3.5.2-2ubuntu0~16.04.4~14.04.1+esm1"
        },
        {
            "binary_name": "python3.5-venv",
            "binary_version": "3.5.2-2ubuntu0~16.04.4~14.04.1+esm1"
        }
    ],
    "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro"
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2018/UBUNTU-CVE-2018-14647.json"