Yüksek CVSS 7.5 PoC var

CVE-2018-20406: Python: tamsayı taşması

Yayın: 24 Aralık 2018 02:29 · Güncelleme: 6 Kasım 2026 09:48

Açıklama (NVD)

Modules/_pickle.c in Python before 3.7.1 has an integer overflow via a large LONG_BINPUT value that is mishandled during a "resize to twice the size" attempt. This issue might cause memory exhaustion, but is only relevant if the pickle format is used for serializing tens or hundreds of gigabytes of data. This issue is fixed in: v3.4.10, v3.4.10rc1; v3.5.10, v3.5.10rc1, v3.5.7, v3.5.7rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.7, v3.6.7rc1, v3.6.7rc2, v3.6.8, v3.6.8rc1, v3.6.9, v3.6.9rc1; v3.7.1, v3.7.1rc1, v3.7.1rc2, v3.7.2, v3.7.2rc1, v3.7.3, v3.7.3rc1, v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.

Özet bilgiler

Ürün: Python Python
CVSS v3.1: 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS: %5,79 (yüzdelik 93)
CWE: CWE-190
Yama: Mevcut

Etkilenen sürümler

Ürün	Başlangıç	Bitiş	Düzeltildi
python-python	3.4.0	—	3.7.1
debian-debian-linux	8.0	8.0	—
fedoraproject-fedora	28	28	—
fedoraproject-fedora	29	29	—
fedoraproject-fedora	30	30	—

Kaynaklar

Uygulamada aç Tüm CVE kayıtları