CVE-2018-1060: Input Validation
Catastrophic backtracking vulnerability was found in Python. Exploitation of a regular expression in pop3lib's apop() method although limited by 2048 chars, can lead to denial of service.
Upstream issue:
https://bugs.python.org/issue32981
Other sources
python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib's apop() method. An attacker could use this flaw to cause denial of service.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2018-1060?
CVE-2018-1060 is classified as a denial of service vulnerability due to catastrophic backtracking in regular expressions.
How do I fix CVE-2018-1060?
To address CVE-2018-1060, upgrade your Python version to 2.7.18 or later, or 3.4.10 or later, depending on your distribution.
Which Python versions are affected by CVE-2018-1060?
CVE-2018-1060 affects Python versions 2.7.0 to 2.7.15 and versions 3.0.0 to 3.6.5.
Can CVE-2018-1060 be exploited remotely?
Exploitation of CVE-2018-1060 may lead to denial of service but is limited by a maximum input size of 2048 characters.
Is there a workaround for CVE-2018-1060?
A temporary workaround for CVE-2018-1060 involves avoiding the use of the vulnerable regular expressions in the pop3lib's apop() method.