CVE-2013-7040
Published: 19 May 2014
Python 2.7 before 3.4 only uses the last eight bits of the prefix to randomize hash values, which causes it to compute hash values without restricting the ability to trigger hash collisions predictably and makes it easier for context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1150.
Notes
Author | Note |
---|---|
mdeslaur | This is being fixed upstream by changing the hashing algorithm to SipHash in python 3.4. See http://www.python.org/dev/peps/pep-0456/ Upstream has no intention of backporting this change to stable releases. We will not be fixing this in older releases. |
Priority
Status
Package | Release | Status |
---|---|---|
python2.6 Launchpad, Ubuntu, Debian |
lucid |
Ignored
|
precise |
Does not exist
|
|
quantal |
Does not exist
|
|
raring |
Does not exist
|
|
saucy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Needs triage
|
|
utopic |
Does not exist
|
|
python2.7 Launchpad, Ubuntu, Debian |
lucid |
Does not exist
|
precise |
Ignored
|
|
quantal |
Ignored
(reached end-of-life)
|
|
raring |
Ignored
(reached end-of-life)
|
|
saucy |
Ignored
|
|
trusty |
Ignored
|
|
upstream |
Needs triage
|
|
utopic |
Ignored
|
|
python3.1 Launchpad, Ubuntu, Debian |
lucid |
Ignored
(reached end-of-life)
|
precise |
Does not exist
|
|
quantal |
Does not exist
|
|
raring |
Does not exist
|
|
saucy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Needs triage
|
|
utopic |
Does not exist
|
|
python3.2 Launchpad, Ubuntu, Debian |
lucid |
Does not exist
|
precise |
Ignored
|
|
quantal |
Ignored
(reached end-of-life)
|
|
raring |
Does not exist
|
|
saucy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Needs triage
|
|
utopic |
Does not exist
|
|
python3.3 Launchpad, Ubuntu, Debian |
lucid |
Does not exist
|
precise |
Does not exist
|
|
quantal |
Ignored
(reached end-of-life)
|
|
raring |
Ignored
(reached end-of-life)
|
|
saucy |
Ignored
|
|
trusty |
Does not exist
|
|
upstream |
Needs triage
|
|
utopic |
Does not exist
|