Re: CPython hash secret can be recoved remotely

[cve-assign () mitre org]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

> This is a followup to CVE-2012-1150 (hash table collision CPU usage DOS
> in CPython)
>
> http://bugs.python.org/issue14621 points out that the hash secret in
> CPython can be recovered remotely, so while the original fix addressed
> the "blind DOS" problem (of being able to DOS any Python based service
> with a single prepared payload), it didn't completely eliminate the
> potential for remote DOS attacks based on hash collisions.
> (http://bugs.python.org/issue14621#msg173455 has the details)
>
> Python 3.4+ will use SipHash by default
> (http://www.python.org/dev/peps/pep-0456), which should resolve the
> vulnerability completely.

Use CVE-2013-7040.

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)

iQEcBAEBAgAGBQJSplDSAAoJEKllVAevmvmsnusH+wZ4KrZq+VgroTsISAbCqcCH
2KVHnCwsVsbfpdFP8J4TLrRKfueFR53lqgGAi5TbMV9LbT7PYmp3PhVnepjG0h9c
1hbcBNnOcex6Nv/t0gEzOpoW7mMAJ5NkkrLa5zQdqpAox5Oa0G5WJWCgUIrCXhsd
xaAJtXC72rWH2iDqvZB8gxVnMAjhbcM+QB5RYHymBh647yTWEm/wY2tuSWGZmmM2
68cof3jY+L0f/UbhpVGKrRKFPVnfqD2TQTwJCYkC0bsAgYf/MVLi7Tw7K0ihi4x0
w5Epxc5dOiN/im1JJq/bnQZmt+JXbenQdKYhnyw1PlHQwG/yJj/8Pboqpu53SGY=
=F0rN
-----END PGP SIGNATURE-----