Vulnerability identifier: #VU10956

Vulnerability risk: Low

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-1000030

CWE-ID: CWE-119

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Python
Universal components / Libraries / Scripting languages

Vendor: Python.org

Description
The vulnerability allows a remote unauthenticated attacker to gain elevated privileges on the target system.

The weakness exists due to race condition. A remote attacker can trigger memory corruption and cause the service to crash or possibly execute arbitrary code with elevated privileges on the target system.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Python: 2.7.0 - 2.7.14

---

External links
http://bugs.python.org/issue31530

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.