CVE-2018-1000030
Python 2.7.14 is vulnerable to a Heap-Buffer-Overflow as well as a Heap-Use-After-Free. Python...
Python 2.7.14 is vulnerable to a Heap-Buffer-Overflow as well as a Heap-Use-After-Free. Python versions prior to 2.7.14 may also be vulnerable and it appears that Python 2.7.17 and prior may also be vulnerable however this has not been confirmed. The vulnerability lies when multiply threads are handling large amounts of data. In both cases there is essentially a race condition that occurs. For the Heap-Buffer-Overflow, Thread 2 is creating the size for a buffer, but Thread1 is already writing to the buffer without knowing how much to write. So when a large amount of data is being processed, it is very easy to cause memory corruption using a Heap-Buffer-Overflow. As for the Use-After-Free, Thread3->Malloc->Thread1->Free's->Thread2-Re-uses-Free'd Memory. The PSRT has stated that this is not a security vulnerability due to the fact that the attacker must be able to run code, however in some situations, such as function as a service, this vulnerability can potentially be used by an attacker to violate a trust boundary, as such the DWF feels this issue deserves a CVE.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Python 2.7.14 is vulnerable to a Heap-Buffer-Overflow as well as a Heap-Use-After-Free. Python versions prior to 2.7.14 may also be vulnerable and it appears that Python 2.7.17 and prior may also be vulnerable however this has not been confirmed. The vulnerability lies when multiply threads are handling large amounts of data. In both cases there is essentially a race condition that occurs. For the Heap-Buffer-Overflow, Thread 2 is creating the size for a buffer, but Thread1 is already writing to the buffer without knowing how much to write. So when a large amount of data is being processed, it is very easy to cause memory corruption using a Heap-Buffer-Overflow. As for the Use-After-Free, Thread3->Malloc->Thread1->Free's->Thread2-Re-uses-Free'd Memory. The PSRT has stated that this is not a security vulnerability due to the fact that the attacker must be able to run code, however in some situations, such as function as a service, this vulnerability can potentially be used by an attacker to violate a trust boundary, as such the DWF feels this issue deserves a CVE.
- Record
CVE-2018-1000030- CVSS 3.0
- 3.6 Low
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L - Updated
- 2026-11-02
EUVDEUVD-2018-1791
Python 2.7.14 is vulnerable to a Heap-Buffer-Overflow as well as a Heap-Use-After-Free. Python versions prior to 2.7.14 may also be vulnerable and it appears that Python 2.7.17 and prior may also be vulnerable however this has not been confirmed. The vulnerability lies when multiply threads are handling large amounts of data. In both cases there is essentially a race condition that occurs. For the Heap-Buffer-Overflow, Thread 2 is creating the size for a buffer, but Thread1 is already writing to the buffer without knowing how much to write. So when a large amount of data is being processed, it is very easy to cause memory corruption using a Heap-Buffer-Overflow. As for the Use-After-Free, Thread3->Malloc->Thread1->Free's->Thread2-Re-uses-Free'd Memory. The PSRT has stated that this is not a security vulnerability due to the fact that the attacker must be able to run code, however in some situations, such as function as a service, this vulnerability can potentially be used by an attacker to violate a trust boundary, as such the DWF feels this issue deserves a CVE.
- Record
EUVD-2018-1791- CVSS 3.0
- 3.6 Low
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-rwj4-fxr5-gh64
Python 2.7.14 is vulnerable to a Heap-Buffer-Overflow as well as a Heap-Use-After-Free. Python...
Python 2.7.14 is vulnerable to a Heap-Buffer-Overflow as well as a Heap-Use-After-Free. Python versions prior to 2.7.14 may also be vulnerable and it appears that Python 2.7.17 and prior may also be vulnerable however this has not been confirmed. The vulnerability lies when multiply threads are handling large amounts of data. In both cases there is essentially a race condition that occurs. For the Heap-Buffer-Overflow, Thread 2 is creating the size for a buffer, but Thread1 is already writing to the buffer without knowing how much to write. So when a large amount of data is being processed, it is very easy to cause memory corruption using a Heap-Buffer-Overflow. As for the Use-After-Free, Thread3->Malloc->Thread1->Free's->Thread2-Re-uses-Free'd Memory. The PSRT has stated that this is not a security vulnerability due to the fact that the attacker must be able to run code, however in some situations, such as function as a service, this vulnerability can potentially be used by an attacker to violate a trust boundary, as such the DWF feels this issue deserves a CVE.
- Record
GHSA-rwj4-fxr5-gh64- CVSS 3.1
- 3.6 Low
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L - Weakness
- CWE-416, CWE-787
- Updated
- 2026-11-02
NVD
Python 2.7.14 is vulnerable to a Heap-Buffer-Overflow as well as a Heap-Use-After-Free. Python versions prior to 2.7.14 may also be vulnerable and it appears that Python 2.7.17 and prior may also be vulnerable however this has not been confirmed. The vulnerability lies when multiply threads are handling large amounts of data. In both cases there is essentially a race condition that occurs. For the Heap-Buffer-Overflow, Thread 2 is creating the size for a buffer, but Thread1 is already writing to the buffer without knowing how much to write. So when a large amount of data is being processed, it is very easy to cause memory corruption using a Heap-Buffer-Overflow. As for the Use-After-Free, Thread3->Malloc->Thread1->Free's->Thread2-Re-uses-Free'd Memory. The PSRT has stated that this is not a security vulnerability due to the fact that the attacker must be able to run code, however in some situations, such as function as a service, this vulnerability can potentially be used by an attacker to violate a trust boundary, as such the DWF feels this issue deserves a CVE.
- Record
CVE-2018-1000030- CVSS 3.1
- 3.6 Low
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L - CVSS 3.0
- 3.6 Low
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L - CVSS 2.0
- 3.3 Low
AV:L/AC:M/Au:N/C:P/I:N/A:P - Weakness
- CWE-416, CWE-787
- Updated
- 2026-11-02
OSVAZL-109623
CVE-2018-1000030 affecting package python-py 1.11.0-1
Python 2.7.14 is vulnerable to a Heap-Buffer-Overflow as well as a Heap-Use-After-Free. Python versions prior to 2.7.14 may also be vulnerable and it appears that Python 2.7.17 and prior may also be vulnerable however this has not been confirmed. The vulnerability lies when multiply threads are handling large amounts of data. In both cases there is essentially a race condition that occurs. For the Heap-Buffer-Overflow, Thread 2 is creating the size for a buffer, but Thread1 is already writing to the buffer without knowing how much to write. So when a large amount of data is being processed, it is very easy to cause memory corruption using a Heap-Buffer-Overflow. As for the Use-After-Free, Thread3->Malloc->Thread1->Free's->Thread2-Re-uses-Free'd Memory. The PSRT has stated that this is not a security vulnerability due to the fact that the attacker must be able to run code, however in some situations, such as function as a service, this vulnerability can potentially be used by an attacker to violate a trust boundary, as such the DWF feels this issue deserves a CVE.
- Record
AZL-109623- CVSS 3.1
- 3.6 Low
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L - Updated
- 2026-11-02
OSV
Python 2.7.14 is vulnerable to a Heap-Buffer-Overflow as well as a Heap-Use-After-Free. Python versions prior to 2.7.14 may also be vulnerable and it appears that Python 2.7.17 and prior may also be vulnerable however this has not been confirmed. The vulnerability lies when multiply threads are handling large amounts of data. In both cases there is essentially a race condition that occurs. For the Heap-Buffer-Overflow, Thread 2 is creating the size for a buffer, but Thread1 is already writing to the buffer without knowing how much to write. So when a large amount of data is being processed, it is very easy to cause memory corruption using a Heap-Buffer-Overflow. As for the Use-After-Free, Thread3->Malloc->Thread1->Free's->Thread2-Re-uses-Free'd Memory. The PSRT has stated that this is not a security vulnerability due to the fact that the attacker must be able to run code, however in some situations, such as function as a service, this vulnerability can potentially be used by an attacker to violate a trust boundary, as such the DWF feels this issue deserves a CVE.
- Record
CVE-2018-1000030- CVSS 3.1
- 3.6 Low
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L - Updated
- 2026-11-02
Show 9 moreShow less
OSVDEBIAN-CVE-2018-1000030
Python 2.7.14 is vulnerable to a Heap-Buffer-Overflow as well as a Heap-Use-After-Free. Python versions prior to 2.7.14 may also be vulnerable and it appears that Python 2.7.17 and prior may also be vulnerable however this has not been confirmed. The vulnerability lies when multiply threads are handling large amounts of data. In both cases there is essentially a race condition that occurs. For the Heap-Buffer-Overflow, Thread 2 is creating the size for a buffer, but Thread1 is already writing to the buffer without knowing how much to write. So when a large amount of data is being processed, it is very easy to cause memory corruption using a Heap-Buffer-Overflow. As for the Use-After-Free, Thread3->Malloc->Thread1->Free's->Thread2-Re-uses-Free'd Memory. The PSRT has stated that this is not a security vulnerability due to the fact that the attacker must be able to run code, however in some situations, such as function as a service, this vulnerability can potentially be used by an attacker to violate a trust boundary, as such the DWF feels this issue deserves a CVE.
- Record
DEBIAN-CVE-2018-1000030- CVSS 3.1
- 3.6 Low
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L - Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-1000030
Python 2.7.14 is vulnerable to a Heap-Buffer-Overflow as well as a Heap-Use-After-Free. Python versions prior to 2.7.14 may also be vulnerable and it appears that Python 2.7.17 and prior may also be vulnerable however this has not been confirmed. The vulnerability lies when multiply threads are handling large amounts of data. In both cases there is essentially a race condition that occurs. For the Heap-Buffer-Overflow, Thread 2 is creating the size for a buffer, but Thread1 is already writing to the buffer without knowing how much to write. So when a large amount of data is being processed, it is very easy to cause memory corruption using a Heap-Buffer-Overflow. As for the Use-After-Free, Thread3->Malloc->Thread1->Free's->Thread2-Re-uses-Free'd Memory. The PSRT has stated that this is not a security vulnerability due to the fact that the attacker must be able to run code, however in some situations, such as function as a service, this vulnerability can potentially be used by an attacker to violate a trust boundary, as such the DWF feels this issue deserves a CVE.
- Record
UBUNTU-CVE-2018-1000030- CVSS 3.1
- 3.6 Low
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L - CVSS 3.0
- 3.6 Low
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L - Updated
- 2026-11-02
OSVCLSA-2026-1778768341 No score
python: Fix of 4 CVEs
- CVE-2019-9740: reject control characters in HTTP URL paths in httplib.HTTPConnection.putrequest to prevent CRLF header injection
- CVE-2019-18348: reject control characters in hostnames in httplib.HTTPConnection.init via a new _validate_host helper to prevent CRLF header injection (the glibc CVE-2016-10739 mitigation shipped on RHEL 7+ is not present on CentOS 6 / Oracle Linux 6 ELS)
- CVE-2018-1000030: cache the readahead buffer thread-locally inside file_iternext to fix heap buffer corruption and crashes when multiple threads iterate over the same file object
- Record
CLSA-2026-1778768341- Updated
- 2026-11-02
OSVCLSA-2026-1778769563 No score
python: Fix of 4 CVEs
- CVE-2019-9740: reject control characters in HTTP URL paths in httplib.HTTPConnection.putrequest to prevent CRLF header injection
- CVE-2019-18348: reject control characters in hostnames in httplib.HTTPConnection.init via a new _validate_host helper to prevent CRLF header injection (the glibc CVE-2016-10739 mitigation shipped on RHEL 7+ is not present on CentOS 6 / Oracle Linux 6 ELS)
- CVE-2018-1000030: cache the readahead buffer thread-locally inside file_iternext to fix heap buffer corruption and crashes when multiple threads iterate over the same file object
- Record
CLSA-2026-1778769563- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11202-1 No score
python-2.7.18-8.1 on GA media
These are all security issues fixed in the python-2.7.18-8.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11202-1- Updated
- 2026-11-02
OSVPSF-2018-2 No score
Python 2.7 readahead is not thread safe
Python 2.7.14 is vulnerable to a Heap-Buffer-Overflow as well as a Heap-Use-After-Free. Python versions prior to 2.7.14 may also be vulnerable and it appears that Python 2.7.17 and prior may also be vulnerable however this has not been confirmed. The vulnerability lies when multiply threads are handling large amounts of data. In both cases there is essentially a race condition that occurs. For the Heap-Buffer-Overflow, Thread 2 is creating the size for a buffer, but Thread1 is already writing to the buffer without knowing how much to write. So when a large amount of data is being processed, it is very easy to cause memory corruption using a Heap-Buffer-Overflow. As for the Use-After-Free, Thread3->Malloc->Thread1->Free's->Thread2-Re-uses-Free'd Memory. The PSRT has stated that this is not a security vulnerability due to the fact that the attacker must be able to run code, however in some situations, such as function as a service, this vulnerability can potentially be used by an attacker to violate a trust boundary, as such the DWF feels this issue deserves a CVE.
- Record
PSF-2018-2- Updated
- 2026-11-02
OSVSUSE-SU-2018:1372-1 No score
Security update for python
This update for python fixes the following issues:
Security issues fixed:
- CVE-2017-1000158: Fixed integer overflows in PyString_DecodeEscape that could have resulted in heap-based buffer overflow attacks and possible arbitrary code execution (bsc#1068664).
- CVE-2018-1000030: Fixed crash inside the Python interpreter when multiple threads used the same I/O stream concurrently (bsc#1079300).
- Record
SUSE-SU-2018:1372-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:0234-1 No score
Security update for python
This update for python fixes the following issues:
Updated to version 2.7.17 to unify packages among openSUSE:Factory and SLE versions (bsc#1159035).
- Record
SUSE-SU-2020:0234-1- Updated
- 2026-11-02
OSVUSN-3817-1 No score
python2.7, python3.4, python3.5 vulnerabilities
It was discovered that Python incorrectly handled large amounts of data. A remote attacker could use this issue to cause Python to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2018-1000030)
It was discovered that Python incorrectly handled running external commands in the shutil module. A remote attacker could use this issue to cause Python to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2018-1000802)
It was discovered that Python incorrectly used regular expressions vulnerable to catastrophic backtracking. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2018-1060, CVE-2018-1061)
It was discovered that Python failed to initialize Expat's hash salt. A remote attacker could possibly use this issue to cause hash collisions, leading to a denial of service. (CVE-2018-14647)
- Record
USN-3817-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
python-pyAzure Linux:3 |
through 1.11.0-1 | None known |
pythonTuxCare:OracleLinux:6 |
before 2.6.6-70.el6.tuxcare.els22 | 2.6.6-70.el6.tuxcare.els22 |
python-develTuxCare:OracleLinux:6 |
before 2.6.6-70.el6.tuxcare.els22 | 2.6.6-70.el6.tuxcare.els22 |
python-libsTuxCare:OracleLinux:6 |
before 2.6.6-70.el6.tuxcare.els22 | 2.6.6-70.el6.tuxcare.els22 |
python-testTuxCare:OracleLinux:6 |
before 2.6.6-70.el6.tuxcare.els22 | 2.6.6-70.el6.tuxcare.els22 |
python-toolsTuxCare:OracleLinux:6 |
before 2.6.6-70.el6.tuxcare.els22 | 2.6.6-70.el6.tuxcare.els22 |
tkinterTuxCare:OracleLinux:6 |
before 2.6.6-70.el6.tuxcare.els22 | 2.6.6-70.el6.tuxcare.els22 |
pythonTuxCare:CentOS:6 |
before 2.6.6-70.el6.tuxcare.els22 | 2.6.6-70.el6.tuxcare.els22 |
python-develTuxCare:CentOS:6 |
before 2.6.6-70.el6.tuxcare.els22 | 2.6.6-70.el6.tuxcare.els22 |
python-libsTuxCare:CentOS:6 |
before 2.6.6-70.el6.tuxcare.els22 | 2.6.6-70.el6.tuxcare.els22 |
Show 29 moreShow less
| Package | Affected | Fixed |
|---|---|---|
python-testTuxCare:CentOS:6 |
before 2.6.6-70.el6.tuxcare.els22 | 2.6.6-70.el6.tuxcare.els22 |
python-toolsTuxCare:CentOS:6 |
before 2.6.6-70.el6.tuxcare.els22 | 2.6.6-70.el6.tuxcare.els22 |
tkinterTuxCare:CentOS:6 |
before 2.6.6-70.el6.tuxcare.els22 | 2.6.6-70.el6.tuxcare.els22 |
python2.7Debian:11 |
before 2.7.14-5 | 2.7.14-5 |
pythonSUSE:Linux Enterprise Desktop 12 SP3 |
before 2.7.13-28.3.2 | 2.7.13-28.3.2 |
python-baseSUSE:Linux Enterprise Desktop 12 SP3 |
before 2.7.13-28.3.2 | 2.7.13-28.3.2 |
python-baseSUSE:Linux Enterprise Software Development Kit 12 SP3 |
before 2.7.13-28.3.2 | 2.7.13-28.3.2 |
pythonSUSE:Linux Enterprise Server 12 SP3 |
before 2.7.13-28.3.2 | 2.7.13-28.3.2 |
python-baseSUSE:Linux Enterprise Server 12 SP3 |
before 2.7.13-28.3.2 | 2.7.13-28.3.2 |
python-docSUSE:Linux Enterprise Server 12 SP3 |
before 2.7.13-28.3.3 | 2.7.13-28.3.3 |
pythonSUSE:Linux Enterprise Server for SAP Applications 12 SP3 |
before 2.7.13-28.3.2 | 2.7.13-28.3.2 |
python-baseSUSE:Linux Enterprise Server for SAP Applications 12 SP3 |
before 2.7.13-28.3.2 | 2.7.13-28.3.2 |
python-docSUSE:Linux Enterprise Server for SAP Applications 12 SP3 |
before 2.7.13-28.3.3 | 2.7.13-28.3.3 |
python-baseSUSE:Linux Enterprise Workstation Extension 12 SP3 |
before 2.7.13-28.3.2 | 2.7.13-28.3.2 |
pythonSUSE:Enterprise Storage 5 |
before 2.7.13-28.3.2 | 2.7.13-28.3.2 |
pythonSUSE:Linux Enterprise Module for Basesystem 15 |
before 2.7.17-7.32.2 | 2.7.17-7.32.2 |
python-baseSUSE:Linux Enterprise Module for Basesystem 15 |
before 2.7.17-7.32.1 | 2.7.17-7.32.1 |
pythonSUSE:Linux Enterprise Module for Basesystem 15 SP1 |
before 2.7.17-7.32.2 | 2.7.17-7.32.2 |
python-baseSUSE:Linux Enterprise Module for Basesystem 15 SP1 |
before 2.7.17-7.32.1 | 2.7.17-7.32.1 |
pythonSUSE:Linux Enterprise Module for Desktop Applications 15 |
before 2.7.17-7.32.2 | 2.7.17-7.32.2 |
pythonSUSE:Linux Enterprise Module for Desktop Applications 15 SP1 |
before 2.7.17-7.32.2 | 2.7.17-7.32.2 |
pythonSUSE:Linux Enterprise Module for Python 2 15 SP1 |
before 2.7.17-7.32.2 | 2.7.17-7.32.2 |
python-baseSUSE:Linux Enterprise Module for Python 2 15 SP1 |
before 2.7.17-7.32.1 | 2.7.17-7.32.1 |
python2.7Ubuntu:14.04:LTS |
before 2.7.6-8ubuntu0.5, plus listed versions 2.7.5-8ubuntu32.7.5-8ubuntu42.7.6-22.7.6-2ubuntu12.7.6-3 Show 9 moreShow less2.7.6-3ubuntu12.7.6-42.7.6-4ubuntu12.7.6-52.7.6-72.7.6-82.7.6-8ubuntu0.22.7.6-8ubuntu0.32.7.6-8ubuntu0.4 |
2.7.6-8ubuntu0.5 |
python2.7Ubuntu:16.04:LTS |
before 2.7.12-1ubuntu0~16.04.4, plus listed versions 2.7.10-4ubuntu12.7.10-4ubuntu22.7.11-22.7.11-32.7.11-4 Show 7 moreShow less2.7.11-62.7.11-72.7.11-7ubuntu12.7.12-1~16.042.7.12-1ubuntu0~16.04.12.7.12-1ubuntu0~16.04.22.7.12-1ubuntu0~16.04.3 |
2.7.12-1ubuntu0~16.04.4 |
python3.4Ubuntu:14.04:LTS |
before 3.4.3-1ubuntu1~14.04.7, plus listed versions 3.4~b1-0ubuntu33.4~b1-4ubuntu43.4~b1-4ubuntu63.4~b1-5ubuntu23.4~b2-1 Show 12 moreShow less3.4~b3-1ubuntu13.4~rc1-1build13.4~rc2-13.4~rc3-0ubuntu13.4.0-13.4.0-2ubuntu13.4.0-2ubuntu1.13.4.3-1ubuntu1~14.04.13.4.3-1ubuntu1~14.04.33.4.3-1ubuntu1~14.04.43.4.3-1ubuntu1~14.04.53.4.3-1ubuntu1~14.04.6 |
3.4.3-1ubuntu1~14.04.7 |
python3.5Ubuntu:16.04:LTS |
before 3.5.2-2ubuntu0~16.04.5, plus listed versions 3.5.0-33.5.0-3ubuntu13.5.1~rc1-2ubuntu13.5.1-13.5.1-2 Show 12 moreShow less3.5.1-33.5.1-53.5.1-6ubuntu13.5.1-6ubuntu23.5.1-9ubuntu13.5.1-103.5.2-2~16.013.5.2-2~16.043.5.2-2ubuntu0~16.04.13.5.2-2ubuntu0~16.04.23.5.2-2ubuntu0~16.04.33.5.2-2ubuntu0~16.04.4 |
3.5.2-2ubuntu0~16.04.5 |
python2.7Ubuntu:18.04:LTS |
before 2.7.15~rc1-1ubuntu0.1, plus listed versions 2.7.14-2ubuntu22.7.14-42.7.14-62.7.14-72.7.14-82.7.15~rc1-1 |
2.7.15~rc1-1ubuntu0.1 |
pythonopenSUSE:Tumbleweed |
before 2.7.18-8.1 | 2.7.18-8.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | tylepr96/CVE-2018-1000030 | 2020-02-10 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-1000030 is a low vulnerability (CVSS 3.6) in Python, published February 8, 2018. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.19%, the 67th percentile. Fixed in python 2.6.6-70.el6.tuxcare.els22.
References
drive.google.com/file/d/1oyR9DAZjZK_SCn3mor6NRAYLJS6ueXaY/view
usn.ubuntu.com/3817-2
security.gentoo.org/glsa/201811-02
dropbox.com/sh/sj3ee7xv55j36k7/AADwP-YfOYikBMuy32e0uvPFa?dl=0
bugs.python.org/issue31530
Show 148 moreShow less
oracle.com/security-alerts/cpujan2020.html
nvd.nist.gov/vuln/detail/CVE-2018-1000030
github.com/advisories/GHSA-rwj4-fxr5-gh64
errata.tuxcare.com/els_os/oraclelinux6els/CLSA-2026-1778768341.html
security-tracker.debian.org/tracker/CVE-2018-1000030
access.redhat.com/security/cve/cve-2018-1000030
suse.com/support/update/announcement/2018/suse-su-20181372-1
bugzilla.suse.com/1068664
ubuntu.com/security/CVE-2018-1000030
cve.org/CVERecord?id=CVE-2018-1000030