CVE-2016-20013

Published: 19 February 2022

sha256crypt and sha512crypt through 0.6 allow attackers to cause a denial of service (CPU consumption) because the algorithm's runtime is proportional to the square of the length of the password.

Notes

Actually addressing this will likely require every site that
is using these password storage formats to make plans for an orderly
transition to argon2 or scrypt or similar before making configuration
changes. We may mark all of these packages as 'ignored' without any
further work.

Despite the risks of applying any changes, there are no
clues that glibc upstream will get this fixed. But just to make sure,
before marking as ignored, I will mark as deferred as of 2022-06-01
so we can revisit it in the future.

Status

Severity score breakdown

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-20013
• https://akkadia.org/drepper/SHA-crypt.txt
• https://pthree.org/2018/05/23/do-not-use-sha256crypt-sha512crypt-theyre-dangerous/
• https://twitter.com/solardiz/status/795601240151457793
• NVD
• Launchpad
• Debian