CVE-2018-14647: High severity Python Python vulnerability
A flaw was found in python's elementtree.c module, a wrapper for libexpat XML parser. xml.etree C accelerator don't call XMLSetHashSalt(), failing to properly initiate the random hash seed from a good CSPRNG source and making hash collision attacks with carefully crafted XML data easier.
Upstream bug:
https://bugs.python.org/issue34623.
Other sources
Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming large amounts CPU and RAM. The vulnerability exists in Python versions 3.7.0, 3.6.0 through 3.6.6, 3.5.0 through 3.5.6, 3.4.0 through 3.4.9, 2.7.0 through 2.7.15.
— Debian
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2018-14647?
CVE-2018-14647 is classified as a medium severity vulnerability due to its potential for hash collision attacks.
How do I fix CVE-2018-14647?
To address CVE-2018-14647, update your Python installation to version 3.7.1, 3.6.7, or 2.7.16 depending on your environment.
Which versions of Python are affected by CVE-2018-14647?
CVE-2018-14647 affects Python versions prior to 2.7.16, 3.6.7, and 3.7.1.
What impact does CVE-2018-14647 have on XML parsing?
CVE-2018-14647 can lead to hash collision vulnerabilities when processing XML due to improper initialization of the random hash seed.
Is CVE-2018-14647 specific to any operating system?
CVE-2018-14647 is not specific to any operating system but affects Python across multiple distributions including Red Hat and Debian.