CVE-2014-9016 – Drupal < 7.34 - Denial of Service

https://notcve.org/view.php?id=CVE-2014-9016

The password hashing API in Drupal 7.x before 7.34 and the Secure Password Hashes (aka phpass) module 6.x-2.x before 6.x-2.1 for Drupal allows remote attackers to cause a denial of service (CPU and memory consumption) via a crafted request. La API del hasheo de contraseñas en Drupal 7.x anterior a 7.34 y el módulo Secure Password Hashes (también conocido como phpass) 6.x-2.x anterior a 6.x-2.1 para Drupal permite a atacantes remotos causar una denegación de servicio (consumo de CPU y memoria) a través de una solicitud manipulada. A vulnerability present in Drupal versions prior to 7.34 and WordPress versions prior to 4.0.1 allows an attacker to send specially crafted requests resulting in CPU and memory exhaustion. This may lead to the site becoming unavailable or unresponsive (denial of service). • https://www.exploit-db.com/exploits/35415 http://secunia.com/advisories/59164 http://secunia.com/advisories/59814 http://www.debian.org/security/2014/dsa-3075 http://www.openwall.com/lists/oss-security/2014/11/20/21 http://www.openwall.com/lists/oss-security/2014/11/20/3 http://www.openwall.com/lists/oss-security/2014/11/21/1 https://www.drupal.org/SA-CORE-2014-006 https://www.drupal.org/node/2378367 https://www.drupal.org/node/2378375 •