oss-security - CPython hash secret can be recoved remotely

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Mon, 09 Dec 2013 15:19:07 +1000
From: Nick Coghlan <ncoghlan@...hat.com>
To: oss-security@...ts.openwall.com
Subject: CPython hash secret can be recoved remotely

Software: CPython
Vendor: Python Software Foundation
Vulnerability: remote target-specific CPU usage DOS

This is a followup to CVE-2012-1150 (hash table collision CPU usage DOS
in CPython)

http://bugs.python.org/issue14621 points out that the hash secret in
CPython can be recovered remotely, so while the original fix addressed
the "blind DOS" problem (of being able to DOS any Python based service
with a single prepared payload), it didn't completely eliminate the
potential for remote DOS attacks based on hash collisions.
(http://bugs.python.org/issue14621#msg173455 has the details)

Python 3.4+ will use SipHash by default
(http://www.python.org/dev/peps/pep-0456), which should resolve the
vulnerability completely.

Regards,
Nick.

-- 
Nick Coghlan
Red Hat Hosted & Shared Services
Software Engineering & Development, Brisbane

Testing Solutions Team Lead
Beaker Development Lead (http://beaker-project.org/)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.