CVE-2013-7040

Published: 19 May 2014

Python 2.7 before 3.4 only uses the last eight bits of the prefix to randomize hash values, which causes it to compute hash values without restricting the ability to trigger hash collisions predictably and makes it easier for context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1150.

Notes

This is being fixed upstream by changing the hashing algorithm
to SipHash in python 3.4.
See http://www.python.org/dev/peps/pep-0456/
Upstream has no intention of backporting this change to stable
releases.
We will not be fixing this in older releases.

Status

References

• http://www.openwall.com/lists/oss-security/2013/12/09
• https://www.cve.org/CVERecord?id=CVE-2013-7040
• NVD
• Launchpad
• Debian

Bugs

• http://bugs.python.org/issue14621
• https://bugs.launchpad.net/ubuntu/+source/python2.7/+bug/1351224