# CVE-2018-14647: Python 3.6 and 2 others: Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization.

CVE-2018-14647 is fixed in 28 products on 2 platforms, first by idle-python2.7 2.7.15~rc1-1ubuntu0.1, released September 23, 2018. 1 other affected product has no fix yet. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2018-14647
- Priority: High
- CVSS: 7.5 (Medium)
- EPSS: 0.1091
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Sep 23, 2018
- Weakness: CWE-665
- Vendor advisory: https://nvd.nist.gov/vuln/detail/CVE-2018-14647

## Description

Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming large amounts CPU and RAM. The vulnerability exists in Python versions 3.7.0, 3.6.0 through 3.6.6, 3.5.0 through 3.5.6, 3.4.0 through 3.4.9, 2.7.0 through 2.7.15.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Windows apps | Python 3.6 | 3.6.7 | [Python 3.6 3.6.7](https://patchblox.com/security/data/fix/windows-app/python.python.3.6-3.6.7.md) | Oct 20, 2018 |
| Windows apps | Python 3.7 | 3.7.1 | [Python 3.7 3.7.1](https://patchblox.com/security/data/fix/windows-app/python.python.3.7-3.7.1.md) | Oct 20, 2018 |
| Linux | idle-python2.7 Ubuntu 18.04.6 LTS (bionic) | 2.7.15~rc1-1ubuntu0.1 | [idle-python2.7 2.7.15~rc1-1ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-idle-python2.7-2.7.15-rc1-1ubuntu0.1.md) | Sep 23, 2018 |
| Linux | idle-python3.6 Ubuntu 18.04.6 LTS (bionic) | 3.6.7-1~18.04 | [idle-python3.6 3.6.7-1~18.04](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-idle-python3.6-3.6.7-1-18.04.md) | Dec 22, 2018 |
| Linux | idle-python3.7 Ubuntu 18.04.6 LTS (bionic) | 3.7.1-1~18.04 | [idle-python3.7 3.7.1-1~18.04](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-idle-python3.7-3.7.1-1-18.04.md) | Sep 23, 2018 |
| Linux | libpython2.7 Ubuntu 18.04.6 LTS (bionic) | 2.7.15~rc1-1ubuntu0.1 | [libpython2.7 2.7.15~rc1-1ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libpython2.7-2.7.15-rc1-1ubuntu0.1.md) | Sep 23, 2018 |
| Linux | libpython2.7-minimal Ubuntu 18.04.6 LTS (bionic) | 2.7.15~rc1-1ubuntu0.1 | [libpython2.7-minimal 2.7.15~rc1-1ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libpython2.7-minimal-2.7.15-rc1-1ubuntu0.1.md) | Sep 23, 2018 |
| Linux | libpython2.7-stdlib Ubuntu 18.04.6 LTS (bionic) | 2.7.15~rc1-1ubuntu0.1 | [libpython2.7-stdlib 2.7.15~rc1-1ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libpython2.7-stdlib-2.7.15-rc1-1ubuntu0.1.md) | Sep 23, 2018 |
| Linux | libpython2.7-testsuite Ubuntu 18.04.6 LTS (bionic) | 2.7.15~rc1-1ubuntu0.1 | [libpython2.7-testsuite 2.7.15~rc1-1ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libpython2.7-testsuite-2.7.15-rc1-1ubuntu0.1.md) | Sep 23, 2018 |
| Linux | libpython3.6 Ubuntu 18.04.6 LTS (bionic) | 3.6.7-1~18.04 | [libpython3.6 3.6.7-1~18.04](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libpython3.6-3.6.7-1-18.04.md) | Dec 22, 2018 |
| Linux | libpython3.6-minimal Ubuntu 18.04.6 LTS (bionic) | 3.6.7-1~18.04 | [libpython3.6-minimal 3.6.7-1~18.04](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libpython3.6-minimal-3.6.7-1-18.04.md) | Dec 22, 2018 |
| Linux | libpython3.6-stdlib Ubuntu 18.04.6 LTS (bionic) | 3.6.7-1~18.04 | [libpython3.6-stdlib 3.6.7-1~18.04](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libpython3.6-stdlib-3.6.7-1-18.04.md) | Dec 22, 2018 |
| Linux | libpython3.6-testsuite Ubuntu 18.04.6 LTS (bionic) | 3.6.7-1~18.04 | [libpython3.6-testsuite 3.6.7-1~18.04](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libpython3.6-testsuite-3.6.7-1-18.04.md) | Dec 22, 2018 |
| Linux | libpython3.7 Ubuntu 18.04.6 LTS (bionic) | 3.7.1-1~18.04 | [libpython3.7 3.7.1-1~18.04](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libpython3.7-3.7.1-1-18.04.md) | Sep 23, 2018 |
| Linux | libpython3.7-minimal Ubuntu 18.04.6 LTS (bionic) | 3.7.1-1~18.04 | [libpython3.7-minimal 3.7.1-1~18.04](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libpython3.7-minimal-3.7.1-1-18.04.md) | Sep 23, 2018 |
| Linux | libpython3.7-stdlib Ubuntu 18.04.6 LTS (bionic) | 3.7.1-1~18.04 | [libpython3.7-stdlib 3.7.1-1~18.04](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libpython3.7-stdlib-3.7.1-1-18.04.md) | Sep 23, 2018 |
| Linux | libpython3.7-testsuite Ubuntu 18.04.6 LTS (bionic) | 3.7.1-1~18.04 | [libpython3.7-testsuite 3.7.1-1~18.04](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libpython3.7-testsuite-3.7.1-1-18.04.md) | Sep 23, 2018 |
| Linux | python2.7 Ubuntu 18.04.6 LTS (bionic) | 2.7.15~rc1-1ubuntu0.1 | [python2.7 2.7.15~rc1-1ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-python2.7-2.7.15-rc1-1ubuntu0.1.md) | Sep 23, 2018 |
| Linux | python2.7-examples Ubuntu 18.04.6 LTS (bionic) | 2.7.15~rc1-1ubuntu0.1 | [python2.7-examples 2.7.15~rc1-1ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-python2.7-examples-2.7.15-rc1-1ubuntu0.1.md) | Sep 23, 2018 |
| Linux | python2.7-minimal Ubuntu 18.04.6 LTS (bionic) | 2.7.15~rc1-1ubuntu0.1 | [python2.7-minimal 2.7.15~rc1-1ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-python2.7-minimal-2.7.15-rc1-1ubuntu0.1.md) | Sep 23, 2018 |
| Linux | python3.6 Ubuntu 18.04.6 LTS (bionic) | 3.6.7-1~18.04 | [python3.6 3.6.7-1~18.04](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-python3.6-3.6.7-1-18.04.md) | Dec 22, 2018 |
| Linux | python3.6-examples Ubuntu 18.04.6 LTS (bionic) | 3.6.7-1~18.04 | [python3.6-examples 3.6.7-1~18.04](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-python3.6-examples-3.6.7-1-18.04.md) | Dec 22, 2018 |
| Linux | python3.6-minimal Ubuntu 18.04.6 LTS (bionic) | 3.6.7-1~18.04 | [python3.6-minimal 3.6.7-1~18.04](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-python3.6-minimal-3.6.7-1-18.04.md) | Dec 22, 2018 |
| Linux | python3.6-venv Ubuntu 18.04.6 LTS (bionic) | 3.6.7-1~18.04 | [python3.6-venv 3.6.7-1~18.04](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-python3.6-venv-3.6.7-1-18.04.md) | Dec 22, 2018 |
| Linux | python3.7 Ubuntu 18.04.6 LTS (bionic) | 3.7.1-1~18.04 | [python3.7 3.7.1-1~18.04](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-python3.7-3.7.1-1-18.04.md) | Sep 23, 2018 |
| Linux | python3.7-examples Ubuntu 18.04.6 LTS (bionic) | 3.7.1-1~18.04 | [python3.7-examples 3.7.1-1~18.04](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-python3.7-examples-3.7.1-1-18.04.md) | Sep 23, 2018 |
| Linux | python3.7-minimal Ubuntu 18.04.6 LTS (bionic) | 3.7.1-1~18.04 | [python3.7-minimal 3.7.1-1~18.04](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-python3.7-minimal-3.7.1-1-18.04.md) | Sep 23, 2018 |
| Linux | python3.7-venv Ubuntu 18.04.6 LTS (bionic) | 3.7.1-1~18.04 | [python3.7-venv 3.7.1-1~18.04](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-python3.7-venv-3.7.1-1-18.04.md) | Sep 23, 2018 |

## No fix yet

| Platform | Product | Status |
|---|---|---|
| Windows apps | Python 3.5 | no-fix |

---

Data as of 2026-11-07T12:40:37Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo