Home page logo

oss-sec logo oss-sec mailing list archives

CPython hash secret can be recoved remotely
From: Nick Coghlan <ncoghlan () redhat com>
Date: Mon, 09 Dec 2013 15:19:07 +1000

Software: CPython
Vendor: Python Software Foundation
Vulnerability: remote target-specific CPU usage DOS

This is a followup to CVE-2012-1150 (hash table collision CPU usage DOS
in CPython)

http://bugs.python.org/issue14621 points out that the hash secret in
CPython can be recovered remotely, so while the original fix addressed
the "blind DOS" problem (of being able to DOS any Python based service
with a single prepared payload), it didn't completely eliminate the
potential for remote DOS attacks based on hash collisions.
(http://bugs.python.org/issue14621#msg173455 has the details)

Python 3.4+ will use SipHash by default
(http://www.python.org/dev/peps/pep-0456), which should resolve the
vulnerability completely.


Nick Coghlan
Red Hat Hosted & Shared Services
Software Engineering & Development, Brisbane

Testing Solutions Team Lead
Beaker Development Lead (http://beaker-project.org/)

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]