Description
python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in the difflib.IS_LINE_JUNK method. An attacker could use this flaw to cause denial of service.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| [UNKNOWN] | python | python 2.7.15, python 3.4.9, python 3.5.6, python 3.7.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 11 | python2.7 | 2.7.14-7 | — |
| Debian 9 | python2.7 | 2.7.13-2+deb9u3 | DSA-4306-1 |
| Debian 9 | python3.5 | 3.5.3-1+deb9u1 | DSA-4307-1 |
| Debian 8 | python2.7 | 2.7.9-2+deb8u2 | DLA-1519-1 |
| Debian 8 | python3.4 | 3.4.2-1+deb8u1 | DLA-1520-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | python3.10 | 3.10.12-1~22.04.4 | USN-6891-1 |
| Ubuntu 20.04 LTS | python3.8 | 3.8.10-0ubuntu1~20.04.10 | USN-6891-1 |
| Ubuntu 18.04 LTS | python2.7 | 2.7.15~rc1-1ubuntu0.1 | USN-3817-1 |
| Ubuntu 16.04 LTS | python2.7 | 2.7.12-1ubuntu0~16.04.4 | USN-3817-1 |
| Ubuntu 16.04 LTS | python3.5 | 3.5.2-2ubuntu0~16.04.5 | USN-3817-1 |
| Ubuntu 14.04 LTS | python2.7 | 2.7.6-8ubuntu0.5 | USN-3817-1 |
| Ubuntu 14.04 LTS | python3.4 | 3.4.3-1ubuntu1~14.04.7 | USN-3817-1 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | python3.11 | 3.11.0~rc1-1~22.04.1~esm1 | USN-6891-1 |
| Ubuntu Pro 20.04 LTS | python3.9 | 3.9.5-3ubuntu0~20.04.1+esm2 | USN-6891-1 |
| Ubuntu Pro 18.04 LTS | python3.6 | 3.6.9-1~18.04ubuntu1.13+esm2 | USN-6891-1 |
| Ubuntu Pro 18.04 LTS | python3.7 | 3.7.5-2ubuntu1~18.04.2+esm3 | USN-6891-1 |
| Ubuntu Pro 18.04 LTS | python3.8 | 3.8.0-3ubuntu1~18.04.2+esm2 | USN-6891-1 |
| Ubuntu Pro 16.04 LTS | python3.5 | 3.5.2-2ubuntu0~16.04.13+esm13 | USN-6891-1 |
| Ubuntu Pro 14.04 LTS | python3.5 | 3.5.2-2ubuntu0~16.04.4~14.04.1+esm1 | USN-6891-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | python +6 | 2.7.5-76.el7 | RHSA-2018:3041 |
| RHEL 3 | python27-python +6 | 2.7.16-4.el6 | RHSA-2019:1260 |
| RHEL 3 | python27-python-jinja2 | 2.6-12.el6 | RHSA-2019:1260 |
| RHEL 3 | rh-python36-python +6 | 3.6.9-2.el6 | RHSA-2019:3725 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7.5 EUS | python +6 | 2.7.5-74.el7_5 | RHSA-2020:1268 |
| RHEL 7.4 TUS | python +6 | 2.7.5-63.el7_4 | RHSA-2020:1346 |
| RHEL 7.4 E4S | python +6 | 2.7.5-63.el7_4 | RHSA-2020:1346 |
| RHEL 7.4 AUS | python +6 | 2.7.5-63.el7_4 | RHSA-2020:1346 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP1 | python | 2.7.17-7.32.2 | SUSE-SU-2020:0234-1 |
| SLES 15 SP1 | python-base | 2.7.17-7.32.1 | SUSE-SU-2020:0234-1 |
| SLES 15 SP1 | python3 +1 | 3.6.10-3.42.2 | SUSE-SU-2020:0114-1 |
| SLES 15 | python | 2.7.17-7.32.2 | SUSE-SU-2020:0234-1 |
| SLES 15 | python-base | 2.7.17-7.32.1 | SUSE-SU-2020:0234-1 |
| SLES 15 | python3 +1 | 3.6.10-3.42.2 | SUSE-SU-2020:0114-1 |
| SLES 12 SP4 | python +2 | 2.7.13-28.16.1 | SUSE-SU-2018:3554-2 |
| SLES 12 SP3 | python +2 | 2.7.13-28.16.1 | SUSE-SU-2018:3554-1 |
| SLES 12 SP3 | python3 +1 | 3.4.6-25.16.1 | SUSE-SU-2018:2696-1 |
| SLES 12 | python3 +1 | 3.4.6-25.16.1 | SUSE-SU-2018:2696-1 |
Show 8 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 11 SP4 | python +1 | 2.6.9-40.15.1 | SUSE-SU-2018:2408-1 |
| SLES 11 SP4 | python-doc | 2.6-8.40.15.1 | SUSE-SU-2018:2408-1 |
| SLES 11 SP3 | python +1 | 2.6.9-40.15.1 | SUSE-SU-2018:2408-1 |
| SLES 11 SP3 | python-doc | 2.6-8.40.15.1 | SUSE-SU-2018:2408-1 |
| SLES 2 | python | 2.7.17-7.32.2 | SUSE-SU-2020:0234-1 |
| SLES 2 | python-base | 2.7.17-7.32.1 | SUSE-SU-2020:0234-1 |
| SLES for SAP 12 SP4 | python +2 | 2.7.13-28.16.1 | SUSE-SU-2018:3554-2 |
| SLES for SAP 12 SP3 | python +2 | 2.7.13-28.16.1 | SUSE-SU-2018:3554-1 |
| SLES for SAP 12 SP3 | python3 +1 | 3.4.6-25.16.1 | SUSE-SU-2018:2696-1 |
| SLES for SAP 11 SP4 | python +1 | 2.6.9-40.15.1 | SUSE-SU-2018:2408-1 |
| SLES for SAP 11 SP4 | python-doc | 2.6-8.40.15.1 | SUSE-SU-2018:2408-1 |
| SUSE Linux Enterprise Point of Sale 11 SP3 | python +1 | 2.6.9-40.15.1 | SUSE-SU-2018:2408-1 |
| SUSE Linux Enterprise Point of Sale 11 SP3 | python-doc | 2.6-8.40.15.1 | SUSE-SU-2018:2408-1 |
| SUSE Enterprise Storage 5 | python | 2.7.13-28.16.1 | SUSE-SU-2018:3554-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python | 2.7.18-8.1 | openSUSE-SU-2024:11202-1 |
| openSUSE Tumbleweed | python36 | 3.6.15-1.1 | openSUSE-SU-2024:11284-1 |
| openSUSE Leap 15.1 | python3 +1 | 3.6.10-lp151.6.7.1 | openSUSE-SU-2020:0086-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.15 | python2 | 2.7.15-r0 | — |
| Alpine v3.14 | python2 | 2.7.15-r0 | — |
| Alpine v3.13 | python2 | 2.7.15-r0 | — |
| Alpine v3.12 | python2 | 2.7.15-r0 | — |
| Alpine v3.11 | python2 +1 | 2.7.15-r0 | — |
Show 6 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.10 | python2 +1 | 2.7.15-r0 | — |
| Alpine v3.9 | python2 +1 | 2.7.15-r0 | — |
| Alpine v3.8 | python3 | 3.6.6-r0 | — |
| Alpine v3.7 | python2 | 2.7.15-r0 | — |
| Alpine v3.7 | python3 | 3.6.5-r0 | — |
| Alpine v3.6 | python2 | 2.7.15-r0 | — |
| Alpine v3.6 | python3 | 3.6.5-r0 | — |
| Alpine v3.5 | python2 | 2.7.15-r0 | — |
| Alpine v3.5 | python3 | 3.5.6-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | python +6 | 2.7.16-1.amzn2.0.1 | ALAS2-2019-1230 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | python-py | No fix yet | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | python +6 | 2.7.5-76.0.1.el7 | ELSA-2018-3041 |
Advisories 23
- RHSA-2020:1268 Red Hat Security Advisory: python security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2020:1346 Red Hat Security Advisory: python security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2019:3725 Red Hat Security Advisory: rh-python36-python security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2019:1260 Red Hat Security Advisory: python27-python and python27-python-jinja2 security and bug fix update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2018:3041 Red Hat Security Advisory: python security and bug fix update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- USN-6891-1 python3.5, python3.6, python3.7, python3.8, python3.9, python3.10, python3.11, python3.12 vulnerabilities Ubuntu Security Notices (USN) · Oct 8, 2026
- USN-3817-1 python2.7, python3.4, python3.5 vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- DSA-4306-1 python2.7 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-4307-1 python3.5 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-1520-1 python3.4 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-1519-1 python2.7 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2018:3554-1 Security update for python, python-base SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:3554-2 Security update for python, python-base SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2020:0086-1 Security update for python3 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:2408-1 Security update for python SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2020:0114-1 Security update for python3 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:2696-1 Security update for python3 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11284-1 python36-3.6.15-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11202-1 python-2.7.18-8.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
- SUSE-SU-2020:0234-1 Security update for python SUSE / openSUSE Security Updates · May 2, 2025
- WID-SEC-2024-1602 Python: Mehrere Schwachstellen ermöglichten Denial of Service BSI CERT-Bund (WID) · Jul 11, 2024
- ALAS2-2019-1230 Important: python security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jul 1, 2019
- ELSA-2018-3041 Moderate: python security and bug fix update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Nov 5, 2018
References
- DSA-4306 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1061
- 1042001 vdb-entry
- [debian-lts-announce] 20180926 [SECURITY] [DLA 1520-1] python3.4 security update mailing-list
- https://bugs.python.org/issue32981
- USN-3817-2 vendor-advisory
- https://docs.python.org/3.6/whatsnew/changelog.html#python-3-6-5-release-candidate-1
- https://docs.python.org/3.5/whatsnew/changelog.html#python-3-5-6-release-candidate-1
- RHSA-2018:3505 vendor-advisory
- RHSA-2018:3041 vendor-advisory
- DSA-4307 vendor-advisory
- USN-3817-1 vendor-advisory
- [debian-lts-announce] 20180925 [SECURITY] [DLA 1519-1] python2.7 security update mailing-list
- FEDORA-2019-6e1938a3c5 vendor-advisory
- FEDORA-2019-cf725dd20b vendor-advisory
- FEDORA-2019-51f1e08207 vendor-advisory
- RHBA-2019:0327 vendor-advisory
- RHSA-2019:1260 vendor-advisory
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03951en_us
- RHSA-2019:3725 vendor-advisory
- openSUSE-SU-2020:0086 vendor-advisory