Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 676706 (CVE-2018-1061) - <dev-lang/python-{2.7.15,3.4.9,3.5.6,3.7.0}: DoS in difflib.IS_LINE_JUNK
Summary: <dev-lang/python-{2.7.15,3.4.9,3.5.6,3.7.0}: DoS in difflib.IS_LINE_JUNK
Status: RESOLVED FIXED
Alias: CVE-2018-1061
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
URL: https://cve.mitre.org/cgi-bin/cvename...
Whiteboard: A4 [noglsa cve]
Keywords:
Depends on:
Blocks:
 
Reported: 2019-01-29 08:41 UTC by psp
Modified: 2019-03-27 02:59 UTC (History)
0 users

See Also:
Package list:
dev-lang/python-{3.4.8,3.5.5}
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description psp 2019-01-29 08:41:08 UTC 
python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in the difflib.IS_LINE_JUNK method. An attacker could use this flaw to cause denial of service.

https://bugs.python.org/issue32981
https://python-security.readthedocs.io/vuln/cve-2018-1060_difflib_and_poplib_catastrophic_backtracking.html

Test:
$ wget -q https://raw.githubusercontent.com/python/cpython/0e6c8ee2358a2e23117501826c008842acb835ac/Lib/test/test_difflib.py

$ python3 --version
Python 3.4.8
$ python3.5 --version
Python 3.5.5

$ python3 test_difflib.py
[...]
test_is_character_junk_false (__main__.TestJunkAPIs) ... ok
test_is_character_junk_true (__main__.TestJunkAPIs) ... ok
test_is_line_junk_REDOS (__main__.TestJunkAPIs) ... 
[hang]

The currently-shipped Python 3.6.5 appears to not be affected.
Comment 1 Aaron Bauman (RETIRED) gentoo-dev 2019-03-27 02:59:36 UTC 
dev-lang/python-3.4* is masked for removal due to being EOL.