CVE-2013-7040
Published: 19 May 2014
Python 2.7 before 3.4 only uses the last eight bits of the prefix to randomize hash values, which causes it to compute hash values without restricting the ability to trigger hash collisions predictably and makes it easier for context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1150.
Notes
Author | Note |
---|---|
mdeslaur | This is being fixed upstream by changing the hashing algorithm to SipHash in python 3.4. See http://www.python.org/dev/peps/pep-0456/ Upstream has no intention of backporting this change to stable releases. We will not be fixing this in older releases. |
Priority
Status
Package | Release | Status |
---|---|---|
python2.6 Launchpad, Ubuntu, Debian |
lucid |
Ignored
|
precise |
Does not exist
|
|
quantal |
Does not exist
|
|
raring |
Does not exist
|
|
saucy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Needs triage
|
|
python2.7 Launchpad, Ubuntu, Debian |
lucid |
Does not exist
|
precise |
Ignored
|
|
quantal |
Ignored
(end of life)
|
|
raring |
Ignored
(end of life)
|
|
saucy |
Ignored
|
|
trusty |
Ignored
|
|
upstream |
Needs triage
|
|
python3.1 Launchpad, Ubuntu, Debian |
lucid |
Ignored
(end of life)
|
precise |
Does not exist
|
|
quantal |
Does not exist
|
|
raring |
Does not exist
|
|
saucy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Needs triage
|
|
python3.2 Launchpad, Ubuntu, Debian |
lucid |
Does not exist
|
precise |
Ignored
|
|
quantal |
Ignored
(end of life)
|
|
raring |
Does not exist
|
|
saucy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Needs triage
|
|
python3.3 Launchpad, Ubuntu, Debian |
lucid |
Does not exist
|
precise |
Does not exist
|
|
quantal |
Ignored
(end of life)
|
|
raring |
Ignored
(end of life)
|
|
saucy |
Ignored
|
|
trusty |
Does not exist
|
|
upstream |
Needs triage
|