Home

CVE-2018-20406

Description

Modules/_pickle.c in Python before 3.7.1 has an integer overflow via a large LONG_BINPUT value that is mishandled during a resize to twice the size attempt. This issue might cause memory exhaustion, but is only relevant if the pickle format is used for serializing tens or hundreds of gigabytes of data. This issue is fixed in: v3.4.10, v3.4.10rc1; v3.5.10, v3.5.10rc1, v3.5.7, v3.5.7rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.7, v3.6.7rc1, v3.6.7rc2, v3.6.8, v3.6.8rc1, v3.6.9, v3.6.9rc1; v3.7.1, v3.7.1rc1, v3.7.1rc2, v3.7.2, v3.7.2rc1, v3.7.3, v3.7.3rc1, v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.

Risk Information

Base Score
7.5
MODERATE
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score
Exploitation Probability
2.005

Associated Vulnerability

VulnerabilityOS Platform
Vulnerability CVE-2018-1061,CVE-2018-14647,CVE-2018-20406 are affected in Python 3.7.0Windows
SUSE-SU-2019:0243-1(SUSE Linux Enterprise Desktop 12-SP4 ) libpython3_4m1_0-3.4.6-25.21.1.x86_64.rpmLinux
SUSE-SU-2019:0243-1(SUSE Linux Enterprise Desktop 12-SP3 ) libpython3_4m1_0-debuginfo-3.4.6-25.21.1.x86_64.rpmLinux
SUSE-SU-2019:0243-1(SUSE Linux Enterprise Desktop 12-SP4 ) python3-3.4.6-25.21.1.x86_64.rpmLinux
SUSE-SU-2019:0243-1(SUSE Linux Enterprise Desktop 12-SP4 ) python3-base-3.4.6-25.21.1.x86_64.rpmLinux
SUSE-SU-2019:0243-1(SUSE Linux Enterprise Desktop 12-SP4 ) python3-base-debuginfo-3.4.6-25.21.1.x86_64.rpmLinux
SUSE-SU-2019:0243-1(SUSE Linux Enterprise Desktop 12-SP4 ) python3-base-debugsource-3.4.6-25.21.1.x86_64.rpmLinux
SUSE-SU-2019:0243-1(SUSE Linux Enterprise Desktop 12-SP4 ) python3-curses-3.4.6-25.21.1.x86_64.rpmLinux
SUSE-SU-2019:0243-1(SUSE Linux Enterprise Desktop 12-SP4 ) python3-curses-debuginfo-3.4.6-25.21.1.x86_64.rpmLinux
SUSE-SU-2019:0243-1(SUSE Linux Enterprise Desktop 12-SP4 ) python3-debuginfo-3.4.6-25.21.1.x86_64.rpmLinux
SUSE-SU-2019:0243-1(SUSE Linux Enterprise Desktop 12-SP4 ) python3-debugsource-3.4.6-25.21.1.x86_64.rpmLinux
An interactive high-level object-oriented language (USN-4127-1) python2.7_2.7.16-2ubuntu0.1_i386.debLinux
An interactive high-level object-oriented language (USN-4127-1) python2.7_2.7.16-2ubuntu0.1_amd64.debLinux
An interactive high-level object-oriented language (USN-4127-1) python2.7_2.7.12-1ubuntu0~16.04.8_i386.debLinux
An interactive high-level object-oriented language (USN-4127-1) python2.7_2.7.12-1ubuntu0~16.04.8_amd64.debLinux
An interactive high-level object-oriented language (USN-4127-1) python2.7_2.7.15-4ubuntu4~18.04.1_i386.debLinux
An interactive high-level object-oriented language (USN-4127-1) python2.7_2.7.15-4ubuntu4~18.04.1_amd64.debLinux
An interactive high-level object-oriented language (USN-4127-1) python3.5_3.5.2-2ubuntu0~16.04.8_i386.debLinux
An interactive high-level object-oriented language (USN-4127-1) python3.5_3.5.2-2ubuntu0~16.04.8_amd64.debLinux
An interactive high-level object-oriented language (USN-4127-1) python3.6_3.6.8-1~18.04.2_i386.debLinux
An interactive high-level object-oriented language (USN-4127-1) python3.6_3.6.8-1~18.04.2_amd64.debLinux
An interactive high-level object-oriented language (USN-4127-1) python3.7_3.7.3-2ubuntu0.1_i386.debLinux
An interactive high-level object-oriented language (USN-4127-1) python3.7_3.7.3-2ubuntu0.1_amd64.debLinux
An interactive high-level object-oriented language (USN-4127-1) python2.7-minimal_2.7.16-2ubuntu0.1_i386.debLinux
An interactive high-level object-oriented language (USN-4127-1) python2.7-minimal_2.7.16-2ubuntu0.1_amd64.debLinux
An interactive high-level object-oriented language (USN-4127-1) python2.7-minimal_2.7.12-1ubuntu0~16.04.8_i386.debLinux
An interactive high-level object-oriented language (USN-4127-1) python2.7-minimal_2.7.12-1ubuntu0~16.04.8_amd64.debLinux
An interactive high-level object-oriented language (USN-4127-1) python2.7-minimal_2.7.15-4ubuntu4~18.04.1_i386.debLinux
An interactive high-level object-oriented language (USN-4127-1) python2.7-minimal_2.7.15-4ubuntu4~18.04.1_amd64.debLinux
An interactive high-level object-oriented language (USN-4127-1) python3.5-minimal_3.5.2-2ubuntu0~16.04.8_i386.debLinux
An interactive high-level object-oriented language (USN-4127-1) python3.5-minimal_3.5.2-2ubuntu0~16.04.8_amd64.debLinux
An interactive high-level object-oriented language (USN-4127-1) python3.6-minimal_3.6.8-1~18.04.2_i386.debLinux
An interactive high-level object-oriented language (USN-4127-1) python3.6-minimal_3.6.8-1~18.04.2_amd64.debLinux
An interactive high-level object-oriented language (USN-4127-1) python3.7-minimal_3.7.3-2ubuntu0.1_i386.debLinux
An interactive high-level object-oriented language (USN-4127-1) python3.7-minimal_3.7.3-2ubuntu0.1_amd64.debLinux
An interactive high-level object-oriented language (USN-6891-1) python3.10_3.10.12-1~22.04.4_amd64.debLinux
An interactive high-level object-oriented language (USN-6891-1) python3.10_3.10.12-1~22.04.4_i386.debLinux
An interactive high-level object-oriented language (USN-6891-1) python3.10-minimal_3.10.12-1~22.04.4_amd64.debLinux
An interactive high-level object-oriented language (USN-6891-1) python3.10-minimal_3.10.12-1~22.04.4_i386.debLinux
An interactive high-level object-oriented language (USN-6891-1) python3.11_3.11.6-3ubuntu0.1_amd64.debLinux
An interactive high-level object-oriented language (USN-6891-1) python3.11_3.11.6-3ubuntu0.1_i386.debLinux
An interactive high-level object-oriented language (USN-6891-1) python3.11-minimal_3.11.6-3ubuntu0.1_amd64.debLinux
An interactive high-level object-oriented language (USN-6891-1) python3.11-minimal_3.11.6-3ubuntu0.1_i386.debLinux
An interactive high-level object-oriented language (USN-6891-1) python3.12_3.12.0-1ubuntu0.1_amd64.debLinux
An interactive high-level object-oriented language (USN-6891-1) python3.12_3.12.0-1ubuntu0.1_i386.debLinux
An interactive high-level object-oriented language (USN-6891-1) python3.12-minimal_3.12.0-1ubuntu0.1_amd64.debLinux
An interactive high-level object-oriented language (USN-6891-1) python3.12-minimal_3.12.0-1ubuntu0.1_i386.debLinux
An interactive high-level object-oriented language (USN-6891-1) python3.8_3.8.10-0ubuntu1~20.04.10_amd64.debLinux
An interactive high-level object-oriented language (USN-6891-1) python3.8_3.8.10-0ubuntu1~20.04.10_i386.debLinux
An interactive high-level object-oriented language (USN-6891-1) python3.8-minimal_3.8.10-0ubuntu1~20.04.10_amd64.debLinux
An interactive high-level object-oriented language (USN-6891-1) python3.8-minimal_3.8.10-0ubuntu1~20.04.10_i386.debLinux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234