CVE-2012-1150 Python before 2.6.8, 2.7.x before 2.7.3, 3.x before 3.1.5, and 3.2.x before 3.2.3 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-depe...
MediumCVSS 5.0
EPSS 5.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Python before 2.6.8, 2.7.x before 2.7.3, 3.x before 3.1.5, and 3.2.x before 3.2.3 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/python2.7(Debian:11) | < 2.7.3~rc1-1 | 2.7.3~rc1-1 |
| python | <= 2.6.7 | No fix listed |
| python | = 0.9.0 | No fix listed |
| python | = 0.9.1 | No fix listed |
| python | = 1.2 | No fix listed |
| python | = 1.3 | No fix listed |
| python | = 1.5.2 | No fix listed |
| python | = 1.6 | No fix listed |
| python | = 1.6.1 | No fix listed |
| python | = 2.0 | No fix listed |
| python | = 2.0.1 | No fix listed |
| python | = 2.1 | No fix listed |
| python | = 2.1.1 | No fix listed |
| python | = 2.1.2 | No fix listed |
| python | = 2.1.3 | No fix listed |
| python | = 2.2 | No fix listed |
| python | = 2.2.1 | No fix listed |
| python | = 2.2.2 | No fix listed |
| python | = 2.2.3 | No fix listed |
| python | = 2.3.1 | No fix listed |
| python | = 2.3.2 | No fix listed |
| python | = 2.3.3 | No fix listed |
| python | = 2.3.4 | No fix listed |
| python | = 2.3.5 | No fix listed |
| python | = 2.3.7 | No fix listed |
Show 34 more
| Product | Affected versions | Fixed in |
|---|---|---|
| python | = 2.4.1 | No fix listed |
| python | = 2.4.2 | No fix listed |
| python | = 2.4.3 | No fix listed |
| python | = 2.4.4 | No fix listed |
| python | = 2.4.6 | No fix listed |
| python | = 2.5.1 | No fix listed |
| python | = 2.5.2 | No fix listed |
| python | = 2.5.3 | No fix listed |
| python | = 2.5.4 | No fix listed |
| python | = 2.5.6 | No fix listed |
| python | = 2.5.150 | No fix listed |
| python | = 2.6.1 | No fix listed |
| python | = 2.6.2 | No fix listed |
| python | = 2.6.3 | No fix listed |
| python | = 2.6.4 | No fix listed |
| python | = 2.6.5 | No fix listed |
| python | = 2.6.6 | No fix listed |
| python | = 2.6.2150 | No fix listed |
| python | = 2.6.6150 | No fix listed |
| python | = 2.7.1 | No fix listed |
| python | = 2.7.1-rc1 | No fix listed |
| python | = 2.7.2-rc1 | No fix listed |
| python | = 2.7.1150 | No fix listed |
| python | = 2.7.2150 | No fix listed |
| python | = 3.0 | No fix listed |
| python | = 3.0.1 | No fix listed |
| python | = 3.1 | No fix listed |
| python | = 3.1.1 | No fix listed |
| python | = 3.1.2 | No fix listed |
| python | = 3.1.3 | No fix listed |
| python | = 3.1.4 | No fix listed |
| python | = 3.2 | No fix listed |
| python | = 3.2-alpha | No fix listed |
| python | = 3.2.2150 | No fix listed |
References
- security-tracker.debian.org vendor-advisory
- bugs.python.org exploit
- APPLE-SA-2013-10-22-3 vendor-advisory
- openSUSE-SU-2020:0086 vendor-advisory
- [python-dev] 20111229 Hash collision security issue (now public) mailing-list
- [python-dev] 20120128 plugging the hash attack mailing-list
- python.org patch vendor-advisory
- python.org patch vendor-advisory
- python.org patch vendor-advisory
- python.org patch vendor-advisory
- 50858 third-party-advisory
- 51087 third-party-advisory
- 51089 third-party-advisory
- [oss-security] 20120309 Re: CVE Request: Python Hash DoS (Issue 13703) mailing-list
- USN-1592-1 vendor-advisory
- USN-1596-1 vendor-advisory
- USN-1615-1 vendor-advisory
- USN-1616-1 vendor-advisory
- bugzilla.redhat.com