CVE-2013-7040
Severity Score
4.3
*CVSS v2
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
Python 2.7 before 3.4 only uses the last eight bits of the prefix to randomize hash values, which causes it to compute hash values without restricting the ability to trigger hash collisions predictably and makes it easier for context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1150.
Python 2.7 anterior a 3.4 solamente utiliza las últimas ocho partes del prefijo para asignar valores de hash de forma aleatoria, lo que causa que calcule valores de hash sin restringir la habilidad de provocar colisiones de hash de forma previsible y facilita a atacantes dependientes de contexto causar una denegación de servicio (consumo de CPU) a través de entradas manipuladas hacia una aplicación que mantiene una tabla de hash. NOTA: esta vulnerabilidad existe debido a una solución incompleta para CVE-2012-1150.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2013-12-09 CVE Reserved
- 2014-05-19 CVE Published
- 2023-12-30 EPSS Updated
- 2024-08-06 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-310: Cryptographic Issues
CAPEC
References (6)
| URL | Tag | Source |
|---|---|---|
| http://bugs.python.org/issue14621 | X_refsource_confirm | |
| http://www.openwall.com/lists/oss-security/2013/12/09/13 | Mailing List |
|
| http://www.openwall.com/lists/oss-security/2013/12/09/3 | Mailing List |
|
| http://www.securityfocus.com/bid/64194 | Vdb Entry |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html | 2019-10-25 | |
| https://support.apple.com/kb/HT205031 | 2019-10-25 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Apple Search vendor "Apple" | Mac Os X Search vendor "Apple" for product "Mac Os X" | <= 10.10.4 Search vendor "Apple" for product "Mac Os X" and version " <= 10.10.4" | - |
Affected
| ||||||
| Python Search vendor "Python" | Python Search vendor "Python" for product "Python" | 2.7.1 Search vendor "Python" for product "Python" and version "2.7.1" | - |
Affected
| ||||||
| Python Search vendor "Python" | Python Search vendor "Python" for product "Python" | 2.7.1 Search vendor "Python" for product "Python" and version "2.7.1" | rc1 |
Affected
| ||||||
| Python Search vendor "Python" | Python Search vendor "Python" for product "Python" | 2.7.2 Search vendor "Python" for product "Python" and version "2.7.2" | rc1 |
Affected
| ||||||
| Python Search vendor "Python" | Python Search vendor "Python" for product "Python" | 2.7.3 Search vendor "Python" for product "Python" and version "2.7.3" | - |
Affected
| ||||||
| Python Search vendor "Python" | Python Search vendor "Python" for product "Python" | 2.7.4 Search vendor "Python" for product "Python" and version "2.7.4" | - |
Affected
| ||||||
| Python Search vendor "Python" | Python Search vendor "Python" for product "Python" | 2.7.5 Search vendor "Python" for product "Python" and version "2.7.5" | - |
Affected
| ||||||
| Python Search vendor "Python" | Python Search vendor "Python" for product "Python" | 2.7.6 Search vendor "Python" for product "Python" and version "2.7.6" | - |
Affected
| ||||||
| Python Search vendor "Python" | Python Search vendor "Python" for product "Python" | 2.7.7 Search vendor "Python" for product "Python" and version "2.7.7" | - |
Affected
| ||||||
| Python Search vendor "Python" | Python Search vendor "Python" for product "Python" | 2.7.1150 Search vendor "Python" for product "Python" and version "2.7.1150" | - |
Affected
| ||||||
| Python Search vendor "Python" | Python Search vendor "Python" for product "Python" | 2.7.2150 Search vendor "Python" for product "Python" and version "2.7.2150" | - |
Affected
| ||||||
| Python Search vendor "Python" | Python Search vendor "Python" for product "Python" | 3.0 Search vendor "Python" for product "Python" and version "3.0" | - |
Affected
| ||||||
| Python Search vendor "Python" | Python Search vendor "Python" for product "Python" | 3.0.1 Search vendor "Python" for product "Python" and version "3.0.1" | - |
Affected
| ||||||
| Python Search vendor "Python" | Python Search vendor "Python" for product "Python" | 3.1 Search vendor "Python" for product "Python" and version "3.1" | - |
Affected
| ||||||
| Python Search vendor "Python" | Python Search vendor "Python" for product "Python" | 3.1.1 Search vendor "Python" for product "Python" and version "3.1.1" | - |
Affected
| ||||||
| Python Search vendor "Python" | Python Search vendor "Python" for product "Python" | 3.1.2 Search vendor "Python" for product "Python" and version "3.1.2" | - |
Affected
| ||||||
| Python Search vendor "Python" | Python Search vendor "Python" for product "Python" | 3.1.3 Search vendor "Python" for product "Python" and version "3.1.3" | - |
Affected
| ||||||
| Python Search vendor "Python" | Python Search vendor "Python" for product "Python" | 3.1.4 Search vendor "Python" for product "Python" and version "3.1.4" | - |
Affected
| ||||||
| Python Search vendor "Python" | Python Search vendor "Python" for product "Python" | 3.1.5 Search vendor "Python" for product "Python" and version "3.1.5" | - |
Affected
| ||||||
| Python Search vendor "Python" | Python Search vendor "Python" for product "Python" | 3.2 Search vendor "Python" for product "Python" and version "3.2" | - |
Affected
| ||||||
| Python Search vendor "Python" | Python Search vendor "Python" for product "Python" | 3.2 Search vendor "Python" for product "Python" and version "3.2" | alpha |
Affected
| ||||||
| Python Search vendor "Python" | Python Search vendor "Python" for product "Python" | 3.2.0 Search vendor "Python" for product "Python" and version "3.2.0" | - |
Affected
| ||||||
| Python Search vendor "Python" | Python Search vendor "Python" for product "Python" | 3.2.1 Search vendor "Python" for product "Python" and version "3.2.1" | - |
Affected
| ||||||
| Python Search vendor "Python" | Python Search vendor "Python" for product "Python" | 3.2.2 Search vendor "Python" for product "Python" and version "3.2.2" | - |
Affected
| ||||||
| Python Search vendor "Python" | Python Search vendor "Python" for product "Python" | 3.2.3 Search vendor "Python" for product "Python" and version "3.2.3" | - |
Affected
| ||||||
| Python Search vendor "Python" | Python Search vendor "Python" for product "Python" | 3.2.4 Search vendor "Python" for product "Python" and version "3.2.4" | - |
Affected
| ||||||
| Python Search vendor "Python" | Python Search vendor "Python" for product "Python" | 3.2.5 Search vendor "Python" for product "Python" and version "3.2.5" | - |
Affected
| ||||||
| Python Search vendor "Python" | Python Search vendor "Python" for product "Python" | 3.2.2150 Search vendor "Python" for product "Python" and version "3.2.2150" | - |
Affected
| ||||||
| Python Search vendor "Python" | Python Search vendor "Python" for product "Python" | 3.3 Search vendor "Python" for product "Python" and version "3.3" | - |
Affected
| ||||||
| Python Search vendor "Python" | Python Search vendor "Python" for product "Python" | 3.3 Search vendor "Python" for product "Python" and version "3.3" | beta2 |
Affected
| ||||||
| Python Search vendor "Python" | Python Search vendor "Python" for product "Python" | 3.3.0 Search vendor "Python" for product "Python" and version "3.3.0" | - |
Affected
| ||||||
| Python Search vendor "Python" | Python Search vendor "Python" for product "Python" | 3.3.1 Search vendor "Python" for product "Python" and version "3.3.1" | - |
Affected
| ||||||
| Python Search vendor "Python" | Python Search vendor "Python" for product "Python" | 3.3.1 Search vendor "Python" for product "Python" and version "3.3.1" | rc1 |
Affected
| ||||||
| Python Search vendor "Python" | Python Search vendor "Python" for product "Python" | 3.3.2 Search vendor "Python" for product "Python" and version "3.3.2" | - |
Affected
| ||||||
| Python Search vendor "Python" | Python Search vendor "Python" for product "Python" | 3.3.3 Search vendor "Python" for product "Python" and version "3.3.3" | - |
Affected
| ||||||
| Python Search vendor "Python" | Python Search vendor "Python" for product "Python" | 3.3.3 Search vendor "Python" for product "Python" and version "3.3.3" | rc1 |
Affected
| ||||||
| Python Search vendor "Python" | Python Search vendor "Python" for product "Python" | 3.3.3 Search vendor "Python" for product "Python" and version "3.3.3" | rc2 |
Affected
| ||||||
| Python Search vendor "Python" | Python Search vendor "Python" for product "Python" | 3.3.4 Search vendor "Python" for product "Python" and version "3.3.4" | - |
Affected
| ||||||
| Python Search vendor "Python" | Python Search vendor "Python" for product "Python" | 3.3.4 Search vendor "Python" for product "Python" and version "3.3.4" | rc1 |
Affected
| ||||||
| Python Search vendor "Python" | Python Search vendor "Python" for product "Python" | 3.3.5 Search vendor "Python" for product "Python" and version "3.3.5" | - |
Affected
| ||||||
| Python Search vendor "Python" | Python Search vendor "Python" for product "Python" | 3.3.5 Search vendor "Python" for product "Python" and version "3.3.5" | rc1 |
Affected
| ||||||
| Python Search vendor "Python" | Python Search vendor "Python" for product "Python" | 3.3.5 Search vendor "Python" for product "Python" and version "3.3.5" | rc2 |
Affected
| ||||||