Denial of Service Vulnerability in Python2 and Python3 Packages
Summary
ALPINE-CVE-2018-14647: Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. Affects python2 versions < 2.7.16-r0. Fixed in 2.7.16-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is a widely-used high-level programming language known for its readability and versatility. The Python2 and Python3 packages in Alpine Linux provide essential tools for executing Python scripts and applications. However, these packages have been found vulnerable to a denial of service attack due to a flaw in the elementtree C accelerator, which can lead to excessive CPU and RAM consumption when processing specially crafted XML documents.
Vulnerability Detail
The vulnerability, identified as CVE-2018-14647, arises from the failure of Python's elementtree C accelerator to initialize Expat's hash salt during startup. This oversight allows attackers to create XML documents that exploit hash collisions within Expat's internal structures, potentially leading to denial of service conditions. The affected versions include Python 2.7.0 through 2.7.15 and Python 3.6.0 through 3.6.6, among others. The CVSS score for this vulnerability is 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
2.7.16-r0
This is the first release that contains the fix.
sudo apk add --upgrade python2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid processing untrusted XML documents or implement input validation to mitigate the risk of denial of service attacks until the packages are updated.
Conclusion
The vulnerability CVE-2018-14647 poses a significant risk to users of Python2 and Python3 packages in Alpine Linux, allowing for potential denial of service attacks. It is crucial to update to the patched versions to mitigate this risk. Users can also utilize Vulert to monitor and alert for open-source vulnerabilities in their software.
See every vulnerability recorded for python2 →
FAQ
CVE-2018-14647 is a vulnerability in Python's elementtree C accelerator that can lead to denial of service attacks through specially crafted XML documents.
Affected versions include Python 2.7.0 through 2.7.15 and Python 3.6.0 through 3.6.6, among others.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
If immediate updates are not possible, avoid processing untrusted XML documents and implement input validation as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for python2.
