CVE-2018-1060

7.5 high SSVC exploitation: none Modified

python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib's apop() method. An attacker could use this flaw to cause denial of service.

Fix

Patch, vendor advisory and mitigation references on NVD 6

https://bugs.python.org/issue32981 Exploit, Issue Tracking, Vendor Advisory
https://docs.python.org/3.5/whatsnew/changelog.html#python-3-5-6-release-candidate-1 Product, Vendor Advisory
https://docs.python.org/3.6/whatsnew/changelog.html#python-3-6-5-release-candidate-1 Product, Vendor Advisory
https://bugs.python.org/issue32981 Exploit, Issue Tracking, Vendor Advisory
https://docs.python.org/3.5/whatsnew/changelog.html#python-3-5-6-release-candidate-1 Product, Vendor Advisory
https://docs.python.org/3.6/whatsnew/changelog.html#python-3-6-5-release-candidate-1 Product, Vendor Advisory

Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.

Change history 1

2026-10-15 00:45First seenCVSS 7.5 · python, fedoraproject, canonicalNVD modified 2026-10-08 21:17

Affected (CPE criteria) 14

cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:28:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
cpe:2.3:a:redhat:ansible_tower:3.3:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

References 44

http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html Mailing List, Third Party Advisory
http://www.securitytracker.com/id/1042001 Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHBA-2019:0327 Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:3041 Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:3505 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1260 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3725 Third Party Advisory
https://bugs.python.org/issue32981 Exploit, Issue Tracking, Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1060 Issue Tracking, Third Party Advisory
https://docs.python.org/3.5/whatsnew/changelog.html#python-3-5-6-release-candidate-1 Product, Vendor Advisory
https://docs.python.org/3.6/whatsnew/changelog.html#python-3-6-5-release-candidate-1 Product, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2018/09/msg00030.html Mailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/09/msg00031.html Mailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46PVWY5LFP4BRPG3BVQ5QEEFYBVEXHCK/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AEZ5IQT7OF7Q2NCGIVABOWYGKO7YU3NJ/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JSKPGPZQNTAULHW4UH63KGOOUIDE4RRB/
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03951en_us Third Party Advisory
https://usn.ubuntu.com/3817-1/ Third Party Advisory
https://usn.ubuntu.com/3817-2/ Third Party Advisory
https://www.debian.org/security/2018/dsa-4306 Third Party Advisory
https://www.debian.org/security/2018/dsa-4307 Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2020.html Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html Mailing List, Third Party Advisory
http://www.securitytracker.com/id/1042001 Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHBA-2019:0327 Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:3041 Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:3505 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1260 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3725 Third Party Advisory
https://bugs.python.org/issue32981 Exploit, Issue Tracking, Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1060 Issue Tracking, Third Party Advisory
https://docs.python.org/3.5/whatsnew/changelog.html#python-3-5-6-release-candidate-1 Product, Vendor Advisory
https://docs.python.org/3.6/whatsnew/changelog.html#python-3-6-5-release-candidate-1 Product, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2018/09/msg00030.html Mailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/09/msg00031.html Mailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46PVWY5LFP4BRPG3BVQ5QEEFYBVEXHCK/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AEZ5IQT7OF7Q2NCGIVABOWYGKO7YU3NJ/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JSKPGPZQNTAULHW4UH63KGOOUIDE4RRB/
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03951en_us Third Party Advisory
https://usn.ubuntu.com/3817-1/ Third Party Advisory
https://usn.ubuntu.com/3817-2/ Third Party Advisory
https://www.debian.org/security/2018/dsa-4306 Third Party Advisory
https://www.debian.org/security/2018/dsa-4307 Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2020.html Third Party Advisory