PatchTheCVECVE-2018-1061: python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking
51
This month
MEDIUM 6.5WATCHLISTUPGRADEMITIGATEDOWNGRADE
CVE-2018-1061 is a medium-severity flaw (CVSS 6.5) affecting python, debian linux, ansible tower. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in the difflib.IS_LINE_JUNK method. An attacker could use this flaw to cause denial of service.
Why this priority
- EPSS top 8%: very likely to be exploited
- On your watchlist
A fixed release or distro patch exists.
Risk facts
| CVSS score | 6.5 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | Required |
| EPSS exploit chance | 4.7% (top 8%) |
| CISA exploited list | No |
| Weakness | CWE-20 |
| Published | 2018-06-19 |
| Last modified | 2026-10-15 |
Last updated 2026-10-15 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
python python UPGRADE
Affected: < 2.7.15 · >= 3.0 and < 3.4.9 · >= 3.5.0 and <= 3.5.5 · >= 3.6 and <= 3.6.4 · 3.7.0 alpha1 · 3.7.0 alpha2 · 3.7.0 alpha3 · 3.7.0 alpha4
Fixed in: 2.7.15, 3.4.9
Safe to downgrade to: a release before 3.0
1. Check installed version
apt-cache policy python || rpm -q python || python --version
2. UPGRADE to 2.7.15 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade python
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade python
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 3.0 (Debian / Ubuntu)
apt-cache madison python
sudo apt install python=<VERSION_BEFORE_3.0>
sudo apt-mark hold python
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list python
sudo dnf downgrade python-<VERSION_BEFORE_3.0>
sudo dnf versionlock add python
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
debian debian linux MITIGATE
Affected: 8.0 · 9.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 8.0
Check your OS release
cat /etc/os-release; uname -r
Debian / Ubuntu
sudo apt update && sudo apt full-upgrade
RHEL / Amazon Linux / Fedora
sudo dnf upgrade --refresh
Windows
Install the latest cumulative update from Windows Update
If no patch exists yet
OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.
redhat ansible tower DOWNGRADE
Affected: 3.3
Fixed in: no fixed release known
Safe to downgrade to: a release before 3.3
1. Check installed version
apt-cache policy ansible-tower || rpm -q ansible-tower || ansible-tower --version
2. No fixed release: DOWNGRADE to a release before 3.3 (Debian / Ubuntu)
apt-cache madison ansible-tower
sudo apt install ansible-tower=<VERSION_BEFORE_3.3>
sudo apt-mark hold ansible-tower
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list ansible-tower
sudo dnf downgrade ansible-tower-<VERSION_BEFORE_3.3>
sudo dnf versionlock add ansible-tower
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
redhat enterprise linux desktop MITIGATE
Affected: 7.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 7.0
Check your OS release
cat /etc/os-release; uname -r
Debian / Ubuntu
sudo apt update && sudo apt full-upgrade
RHEL / Amazon Linux / Fedora
sudo dnf upgrade --refresh
Windows
Install the latest cumulative update from Windows Update
If no patch exists yet
OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.
redhat enterprise linux server MITIGATE
Affected: 7.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 7.0
Check your OS release
cat /etc/os-release; uname -r
Debian / Ubuntu
sudo apt update && sudo apt full-upgrade
RHEL / Amazon Linux / Fedora
sudo dnf upgrade --refresh
Windows
Install the latest cumulative update from Windows Update
If no patch exists yet
OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.
redhat enterprise linux workstation MITIGATE
Affected: 7.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 7.0
Check your OS release
cat /etc/os-release; uname -r
Debian / Ubuntu
sudo apt update && sudo apt full-upgrade
RHEL / Amazon Linux / Fedora
sudo dnf upgrade --refresh
Windows
Install the latest cumulative update from Windows Update
If no patch exists yet
OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2018-1061?
python: upgrade to 2.7.15, 3.4.9; debian linux: mitigate or apply the listed mitigation; ansible tower: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2018-1061 being exploited?
CVE-2018-1061 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2018-1061 affect?
CVE-2018-1061 affects python, debian linux, ansible tower. Severity is medium (CVSS 6.5). python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in the difflib.IS_LINE_JUNK method. An attacker could use this flaw to cause denial of service.
How urgent is CVE-2018-1061?
Priority 51/100. EPSS top 8%: very likely to be exploited; On your watchlist
Software pages
Python vulnerabilities · Ansible vulnerabilities · Debian vulnerabilities
Related CVEs
- CVE-2024-9287 HIGH 7.8 UPGRADE A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a
- CVE-2026-3087 HIGH 7.5 UPGRADE If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...
- CVE-2026-6019 MEDIUM 6.1 UPGRADE http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string co
- CVE-2026-7210 HIGH 7.5 UPGRADE `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, w
- CVE-2026-0864 MEDIUM 5.5 UPGRADE When using the "configparser" module to write configuration files containing multi-line text values with carri