Skip to content
Fencer Vulns
low 3.6

CVE-2018-1000030 json

Python 2.7.14 is vulnerable to a Heap-Buffer-Overflow as well as a Heap-Use-After-Free.

published 2018-02-08 8 y ago modified 2026-10-08 31 d ago also EUVD-2018-1791

cvss
3.6
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.2%
EPSS 1.2% chance of exploitation in 30 days, percentile 68%
public exploits
0
none known

Summary

Python 2.7.14 is vulnerable to a Heap-Buffer-Overflow as well as a Heap-Use-After-Free. Python versions prior to 2.7.14 may also be vulnerable and it appears that Python 2.7.17 and prior may also be vulnerable however this has not been confirmed. The vulnerability lies when multiply threads are handling large amounts of data. In both cases there is essentially a race condition that occurs. For the Heap-Buffer-Overflow, Thread 2 is creating the size for a buffer, but Thread1 is already writing to the buffer without knowing how much to write. So when a large amount of data is being processed, it is very easy to cause memory corruption using a Heap-Buffer-Overflow. As for the Use-After-Free, Thread3->Malloc->Thread1->Free's->Thread2-Re-uses-Free'd Memory. The PSRT has stated that this is not a security vulnerability due to the fact that the attacker must be able to run code, however in some situations, such as function as a service, this vulnerability can potentially be used by an attacker to violate a trust boundary, as such the DWF feels this issue deserves a CVE.

Patch / fix

  • python2.7 Debian 11 2.7.14-5

debian advisories DEBIAN-CVE-2018-1000030

  • python2.7 Ubuntu 14.04 LTS 2.7.6-8ubuntu0.5
  • python2.7 Ubuntu 16.04 LTS 2.7.12-1ubuntu0~16.04.4

ubuntu advisories UBUNTU-CVE-2018-1000030

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • python SLE Module for Python 2 15 SP1, SLE Module for Desktop Applications 15 SP1, SLE Module for Desktop Applications 15 +2 more 2.7.17-7.32.2
  • python-base SLE Module for Python 2 15 SP1, SLE Module for Basesystem 15 SP1, SLE Module for Basesystem 15 2.7.17-7.32.1
  • python SLES for SAP 12 SP3, SLES 12 SP3, SLED 12 SP3 +1 more 2.7.13-28.3.2
  • python-base SLES for SAP 12 SP3, SLES 12 SP3, SLED 12 SP3 +2 more 2.7.13-28.3.2

suse advisories SUSE-SU-2020:0234-1SUSE-SU-2018:1372-1

  • python openSUSE Tumbleweed 2.7.18-8.1

opensuse advisories openSUSE-SU-2024:11202-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-1000030 updated cvss 3.6

python: Heap-Buffer-Overflow and Heap-Use-After-Free in Objects/fileobject.c

  • Red Hat Enterprise Linux 5 python Red Hat Enterprise Linux 6 python, tkinter, python-libs, python-test, python-tools Red Hat Enterprise Linux 7 python, tkinter, python-libs, python-test, python-tools Red Hat Software Collections python27-python, python27-tkinter, python27-python-libs, python27-python-test, python27-python-tools
    affected: no fix planned “Will not fix”
  • Red Hat Software Collections rh-python34-python, rh-python35-python, rh-python36-python, rh-python34-python-libs, rh-python34-python-test, rh-python35-python-libs, +9 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
31 d ago

Exploit prediction

1.19% chance of exploitation in the next 30 days, higher than 68% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.0 3.6 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L
NVD 3.1 3.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L
NVD 2.0 3.3 AV:L/AC:M/Au:N/C:P/I:N/A:P

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.