--- id: CVE-2018-1060 title: >- python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib's apop() method summary: >- python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib's apop() method. An attacker could use this flaw to cause denial of service. severity: high cvss: 7.5 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H' cwe: - CWE-20 vendor: python product: python affected: - 'python >= 2.7.0, < 2.7.15' - 'python >= 3.0.0, < 3.4.9' - 'python >= 3.5.0, < 3.5.6' - 'python > 3.6.0, < 3.6.5' - fedora = 28 - fedora = 29 - fedora = 30 - ubuntu_linux = 12.04 - ubuntu_linux = 14.04 - ubuntu_linux = 16.04 - ubuntu_linux = 18.04 - ansible_tower = 3.3 - enterprise_linux_desktop = 7.0 - enterprise_linux_server = 7.0 - enterprise_linux_workstation = 7.0 - debian_linux = 8.0 - debian_linux = 9.0 patched: - python 3.6.5 published: '2018-06-18' updated: '2026-10-08' sourceUpdated: '2026-10-08T21:17:08.940' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2018-1060' references: - url: 'http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html' label: secalert@redhat.com - url: 'http://www.securitytracker.com/id/1042001' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHBA-2019:0327' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2018:3041' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2018:3505' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2019:1260' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2019:3725' label: secalert@redhat.com - url: 'https://bugs.python.org/issue32981' label: secalert@redhat.com - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1060' label: secalert@redhat.com - url: >- https://docs.python.org/3.5/whatsnew/changelog.html#python-3-5-6-release-candidate-1 label: secalert@redhat.com - url: >- https://docs.python.org/3.6/whatsnew/changelog.html#python-3-6-5-release-candidate-1 label: secalert@redhat.com - url: 'https://lists.debian.org/debian-lts-announce/2018/09/msg00030.html' label: secalert@redhat.com - url: 'https://lists.debian.org/debian-lts-announce/2018/09/msg00031.html' label: secalert@redhat.com - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46PVWY5LFP4BRPG3BVQ5QEEFYBVEXHCK/ label: secalert@redhat.com - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AEZ5IQT7OF7Q2NCGIVABOWYGKO7YU3NJ/ label: secalert@redhat.com - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JSKPGPZQNTAULHW4UH63KGOOUIDE4RRB/ label: secalert@redhat.com - url: >- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03951en_us label: secalert@redhat.com - url: 'https://usn.ubuntu.com/3817-1/' label: secalert@redhat.com - url: 'https://usn.ubuntu.com/3817-2/' label: secalert@redhat.com - url: 'https://www.debian.org/security/2018/dsa-4306' label: secalert@redhat.com - url: 'https://www.debian.org/security/2018/dsa-4307' label: secalert@redhat.com - url: 'https://www.oracle.com/security-alerts/cpujan2020.html' label: secalert@redhat.com - url: 'http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://www.securitytracker.com/id/1042001' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHBA-2019:0327' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2018:3041' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2018:3505' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2019:1260' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2019:3725' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://bugs.python.org/issue32981' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1060' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://docs.python.org/3.5/whatsnew/changelog.html#python-3-5-6-release-candidate-1 label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://docs.python.org/3.6/whatsnew/changelog.html#python-3-6-5-release-candidate-1 label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://lists.debian.org/debian-lts-announce/2018/09/msg00030.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://lists.debian.org/debian-lts-announce/2018/09/msg00031.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46PVWY5LFP4BRPG3BVQ5QEEFYBVEXHCK/ label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AEZ5IQT7OF7Q2NCGIVABOWYGKO7YU3NJ/ label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JSKPGPZQNTAULHW4UH63KGOOUIDE4RRB/ label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03951en_us label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://usn.ubuntu.com/3817-1/' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://usn.ubuntu.com/3817-2/' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.debian.org/security/2018/dsa-4306' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.debian.org/security/2018/dsa-4307' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpujan2020.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2018/cve-2018-1060.json - url: 'https://access.redhat.com/security/cve/CVE-2018-1060' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=1549191' - url: 'https://www.cve.org/CVERecord?id=CVE-2018-1060' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2018-1060' - url: 'https://docs.python.org/3.6/whatsnew/changelog.html#python-3-6-5-final' - url: 'https://access.redhat.com/errata/RHSA-2020:1268' - url: 'https://access.redhat.com/errata/RHSA-2020:1346' tags: - nvd - csaf - vex - red-hat - cve.org - score-dispute epss: 0.05039 epssPercentile: 0.92243 ingestedAt: '2026-10-08T22:11:53.693Z' scores: nvd: 7.5 vendor: 4.3 cna: 4.3 ssvc: exploitation: none automatable: 'yes' technicalImpact: partial timestamp: '2026-10-08T20:55:43.581364Z' --- ## Overview python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib's apop() method. An attacker could use this flaw to cause denial of service. ## Affected - `python >= 2.7.0, < 2.7.15` - `python >= 3.0.0, < 3.4.9` - `python >= 3.5.0, < 3.5.6` - `python > 3.6.0, < 3.6.5` - `fedora = 28` - `fedora = 29` - `fedora = 30` - `ubuntu_linux = 12.04` - `ubuntu_linux = 14.04` - `ubuntu_linux = 16.04` - `ubuntu_linux = 18.04` - `ansible_tower = 3.3` - `enterprise_linux_desktop = 7.0` - `enterprise_linux_server = 7.0` - `enterprise_linux_workstation = 7.0` - `debian_linux = 8.0` - `debian_linux = 9.0` ## Remediation Upgrade past the affected range: - `python 3.6.5` ## Vendor advisories - **RHSA-2019:1260** · Red Hat · fixed in: Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6), Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6), Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7), Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4), Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5), Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6), … · released 2019-05-22 · [advisory](https://access.redhat.com/errata/RHSA-2019:1260) - **RHSA-2019:3725** · Red Hat · fixed in: Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6), Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6), Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7), Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5), Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6), Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7), … · released 2019-11-06 · [advisory](https://access.redhat.com/errata/RHSA-2019:3725) - **RHSA-2018:3041** · Red Hat · fixed in: Red Hat Enterprise Linux Client (v. 7), Red Hat Enterprise Linux Client Optional (v. 7), Red Hat Enterprise Linux ComputeNode (v. 7), Red Hat Enterprise Linux ComputeNode Optional (v. 7), Red Hat Enterprise Linux Server (v. 7), Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7), … · released 2018-10-30 · [advisory](https://access.redhat.com/errata/RHSA-2018:3041) - **RHSA-2020:1268** · Red Hat · fixed in: Red Hat Enterprise Linux ComputeNode EUS (v. 7.5), Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.5), Red Hat Enterprise Linux Server EUS (v. 7.5), Red Hat Enterprise Linux Server Optional EUS (v. 7.5) · released 2020-04-01 · [advisory](https://access.redhat.com/errata/RHSA-2020:1268) - **RHSA-2020:1346** · Red Hat · fixed in: Red Hat Enterprise Linux Server AUS (v. 7.4), Red Hat Enterprise Linux Server E4S (v. 7.4), Red Hat Enterprise Linux Server TUS (v. 7.4), Red Hat Enterprise Linux Server Optional AUS (v. 7.4), Red Hat Enterprise Linux Server Optional E4S (v. 7.4), Red Hat Enterprise Linux Server Optional TUS (v. 7.4) · released 2020-04-07 · [advisory](https://access.redhat.com/errata/RHSA-2020:1346) - **Red Hat VEX** · Low · affected: Red Hat Enterprise Linux 5, Red Hat Enterprise Linux 6, Red Hat Software Collections · no fix planned: Red Hat Enterprise Linux 5, Red Hat Enterprise Linux 6, Red Hat Software Collections · updated 2026-10-08 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2018/cve-2018-1060.json)