Your submission was sent successfully! Close

CVE-2013-7040

Published: 19 May 2014

Python 2.7 before 3.4 only uses the last eight bits of the prefix to randomize hash values, which causes it to compute hash values without restricting the ability to trigger hash collisions predictably and makes it easier for context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1150.

Notes

AuthorNote
mdeslaur
This is being fixed upstream by changing the hashing algorithm
to SipHash in python 3.4.
See http://www.python.org/dev/peps/pep-0456/
Upstream has no intention of backporting this change to stable
releases.
We will not be fixing this in older releases.
Priority

Low

Status

Package Release Status
python2.6
Launchpad, Ubuntu, Debian
lucid Ignored

precise Does not exist

quantal Does not exist

raring Does not exist

saucy Does not exist

trusty Does not exist

upstream Needs triage

utopic Does not exist

python2.7
Launchpad, Ubuntu, Debian
lucid Does not exist

precise Ignored

quantal Ignored
(reached end-of-life)
raring Ignored
(reached end-of-life)
saucy Ignored

trusty Ignored

upstream Needs triage

utopic Ignored

python3.1
Launchpad, Ubuntu, Debian
lucid Ignored
(reached end-of-life)
precise Does not exist

quantal Does not exist

raring Does not exist

saucy Does not exist

trusty Does not exist

upstream Needs triage

utopic Does not exist

python3.2
Launchpad, Ubuntu, Debian
lucid Does not exist

precise Ignored

quantal Ignored
(reached end-of-life)
raring Does not exist

saucy Does not exist

trusty Does not exist

upstream Needs triage

utopic Does not exist

python3.3
Launchpad, Ubuntu, Debian
lucid Does not exist

precise Does not exist

quantal Ignored
(reached end-of-life)
raring Ignored
(reached end-of-life)
saucy Ignored

trusty Does not exist

upstream Needs triage

utopic Does not exist