CVE-2017-18207 Denial of service in n/a

What is CVE-2017-18207?

CVE-2017-18207 is a medium-severity denial of service vulnerability in Python Python, published on 1 Mar 2018. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

The Wave_read._read_fmt_chunk function in Lib/wave.py in Python through 3.6.4 does not ensure a nonzero channel value, which allows attackers to cause a denial of service (divide-by-zero and exception) via a crafted wav format audio file. NOTE: the vendor disputes this issue because Python applications "need to be prepared to handle a wide variety of exceptions.

Weakness: CWE-369

Which versions are affected by CVE-2017-18207?

It affects 1 product.

Products include Python Python.

How do I fix CVE-2017-18207?

Apply the vendor's patch.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2017-18207 being exploited?

There is no known exploitation of CVE-2017-18207 in the wild and no public exploit code.

Other vulnerabilities in Python Python

• CVE-2008-5031 Integer overflow in n/a Critical 10.0
• CVE-2014-4650 Path traversal in n/a Critical 9.8
• CVE-2016-5636 Integer overflow in n/a Critical 9.8
• CVE-2007-4559 Path traversal in n/a Critical 9.8
• CVE-2017-17522 Command injection in n/a High 8.8

All Python Python vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as AZL-109620, AZL-6824, GHSA-h3x9-7xx2-w832, SUSE-SU-2018:0934-1, SUSE-SU-2018:1786-1, SUSE-SU-2018:2040-1 and 1 more.