Denial of Service Vulnerability in Python's elementtree C Accelerator
Summary
CVE-2018-14647: Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. Affects python2 across 6 version ranges.
< 1bf9cc509326bc42cd8cb1650eb9bf64550d817e
< 2.7.16-r0
>= 2e789a1f1d84b343a996e8654590703b5fbdd441, <= 627d0c61ac96009450e3794a2401f244e56fcb79
>= 5c4568a05a0a62b5947c55f68f9f2ecfb90a4f12, <= 4cf1f54eb764f856fda5a394d8598c0c90d69d77
>= 3101b7076270756f8be699358c69c5d15ea2cc48, <= 0a5a5af9b6b47727c5ee3def4508dab312949075
< ca079a3ea30098aff3197c559a0e32d42dda6d84
Fixed in 2.7.16-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is a popular programming language known for its simplicity and versatility. It includes a module called elementtree, which provides a fast and efficient way to parse and manipulate XML data. The elementtree module includes a C accelerator that improves performance by optimizing certain operations. However, a vulnerability has been discovered in the elementtree C accelerator that can be exploited to conduct denial of service attacks against the Expat library, which is used by elementtree for XML parsing. This vulnerability affects Python versions 2.7.0 through 2.7.15, 3.4.0 through 3.4.9, 3.5.0 through 3.5.6, 3.6.0 through 3.6.6, and 3.7.0.
Vulnerability Detail
The vulnerability arises from the elementtree C accelerator's failure to initialize Expat's hash salt during initialization. This oversight allows an attacker to construct a specially crafted XML document that triggers pathological hash collisions in Expat's internal data structures. As a result, the CPU and RAM usage of the affected system can be significantly increased, leading to a denial of service condition. This vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
2.7.16-r0
This is the first release that contains the fix.
sudo apk add --upgrade python2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating Python is not immediately feasible, a temporary workaround is to disable the elementtree C accelerator by setting the environment variable 'PYTHONDONTWRITEBYTECODE' to '1'. This can be done by running the following command before executing Python scripts: export PYTHONDONTWRITEBYTECODE=1
Conclusion
The denial of service vulnerability in Python's elementtree C accelerator can be mitigated by updating Python to the fixed versions or by temporarily disabling the accelerator. It is important to promptly address this vulnerability to prevent potential performance degradation or system unresponsiveness. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for python2 →
FAQ
The vulnerability allows an attacker to consume excessive CPU and RAM resources on the affected system, leading to a denial of service condition. This can result in degraded performance or even system unresponsiveness.
No, only specific versions of Python are affected. The vulnerability exists in Python versions 2.7.0 through 2.7.15, 3.4.0 through 3.4.9, 3.5.0 through 3.5.6, 3.6.0 through 3.6.6, and 3.7.0.
Yes, the vulnerability can be fixed by updating Python to the appropriate fixed versions: 2.7.16-r0 for Python 2.7, 3.6.8-r0 for Python 3.6, and 3.7.16-r0 for Python 3.7.
Yes, a temporary workaround is available. By setting the environment variable 'PYTHONDONTWRITEBYTECODE' to '1', the elementtree C accelerator can be disabled, mitigating the vulnerability. However, updating Python to the fixed versions is still recommended.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Python installation is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will analyze the dependencies and alert you if any vulnerabilities are found.
References
Related vulnerabilities
Recent vulnerabilities recorded for python2.
