CVE-2018-1061: Input Validation
Catastrophic backtracking vulnerability was found in Python. Exploitation of a regular expression in difflib.ISLINEJUNK method in servers that use difflib can lead to denial of service.
Upstream issue:
https://bugs.python.org/issue32981
Other sources
python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in the difflib.ISLINEJUNK method. An attacker could use this flaw to cause denial of service.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2018-1061?
CVE-2018-1061 is classified as a denial of service vulnerability due to catastrophic backtracking in regular expressions.
How do I fix CVE-2018-1061?
To fix CVE-2018-1061, upgrade to Python versions 2.7.18 or higher, 3.4.10 or higher, 3.5.7 or higher, or 3.7.1 or higher.
What versions of Python are affected by CVE-2018-1061?
CVE-2018-1061 affects Python versions up to and including 2.7.15, 3.4.9, 3.5.6, and 3.7.0.
What impact does CVE-2018-1061 have on servers?
Exploitation of CVE-2018-1061 can lead to denial of service on servers using the difflib.IS_LINE_JUNK method.
Are there any known exploits for CVE-2018-1061?
As of now, there are no public details about known exploits targeting CVE-2018-1061.