Bug 1166254 (CVE-2014-9016)

Summary:	CVE-2014-9016 drupal7: Denial of service in password hashing API (SA-CORE-2014-006)
Product:	[Other] Security Response	Reporter:	Vasyl Kaigorodov <vkaigoro>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	carnil, gwync, jsmith.fedora, peter.borsa, shawn, stickster, vkaigoro
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	Drupal 7.34	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-01-05 11:24:56 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1166256, 1166257
Bug Blocks:

Description Vasyl Kaigorodov 2014-11-20 16:26:39 UTC

Latest Drupal advisory [1] fixes denial of service vulnerability.
Drupal 7 includes a password hashing API to ensure that user supplied passwords are not stored in plain text.

A vulnerability in this API allows an attacker to send specially crafted requests resulting in CPU and memory exhaustion. This may lead to the site becoming unavailable or unresponsive (denial of service).

This vulnerability can be exploited by anonymous users.

[1]: https://www.drupal.org/SA-CORE-2014-006

Comment 1 Vasyl Kaigorodov 2014-11-20 16:29:49 UTC

Created drupal7 tracking bugs for this issue:

Affects: fedora-all [bug 1166256]
Affects: epel-all [bug 1166257]

Comment 2 Fedora Update System 2014-12-03 01:03:37 UTC

drupal7-7.34-1.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 3 Fedora Update System 2014-12-03 01:05:34 UTC

drupal7-7.34-1.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 4 Fedora Update System 2014-12-06 10:05:16 UTC

drupal7-7.34-1.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 5 Fedora Update System 2014-12-11 06:26:43 UTC

drupal7-7.34-1.el6 has been pushed to the Fedora EPEL 6 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 6 Fedora Update System 2014-12-11 06:28:09 UTC

drupal7-7.34-1.el7 has been pushed to the Fedora EPEL 7 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 7 Fedora Update System 2014-12-11 06:31:38 UTC

drupal7-7.34-1.el5 has been pushed to the Fedora EPEL 5 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 8 Shawn Iwinski 2015-01-03 05:02:30 UTC

All dependent bugs have been addressed and closed.  Can this bug be closed?

Comment 9 Vasyl Kaigorodov 2015-01-05 11:24:56 UTC

(In reply to Shawn Iwinski from comment #8)
> All dependent bugs have been addressed and closed.  Can this bug be closed?

Yes, setting CLOSED/ERRATA here.