CVE-2014-9016 The password hashing API in Drupal 7.x before 7.34 and the Secure Password Hashes (aka phpass) module 6.x-2.x before 6.x-2.1 for Drupal allows remote attackers to cause a denial of service (CPU and me...
MediumCVSS 5.0
EPSS 79.1%
Framework module
PoC
- Published
- Updated
- Exploit status
- Public exploit available
Description
The password hashing API in Drupal 7.x before 7.34 and the Secure Password Hashes (aka phpass) module 6.x-2.x before 6.x-2.1 for Drupal allows remote attackers to cause a denial of service (CPU and memory consumption) via a crafted request.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| drupal/drupal | >= 7.0, < 7.34 | 7.34 |
| secure password hashes project secure passwords hashes | >= 6.x-2.0, < 6.x-2.1 | 6.x-2.1 |
| debian linux | = 7.0 | No fix listed |
References
- 59164 third-party-advisory
- 59814 third-party-advisory
- DSA-3075 third-party-advisory vendor-advisory
- [oss-security] 20141120 Re: [security] Pending CVE assignments for SA-CORE-2014-006? mailing-list third-party-advisory
- [oss-security] 20141120 Pending CVE assignments for SA-CORE-2014-006? mailing-list third-party-advisory
- [oss-security] 20141120 Re: [security] Pending CVE assignments for SA-CORE-2014-006? mailing-list third-party-advisory
- www.drupal.org vendor-advisory
- www.drupal.org patch vendor-advisory
- www.drupal.org patch vendor-advisory