Bug 1166254 (CVE-2014-9016) - CVE-2014-9016 drupal7: Denial of service in password hashing API (SA-CORE-2014-006)
Summary: CVE-2014-9016 drupal7: Denial of service in password hashing API (SA-CORE-201...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2014-9016
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1166256 1166257
Blocks:
TreeView+ depends on / blocked
 
Reported: 2014-11-20 16:26 UTC by Vasyl Kaigorodov
Modified: 2019-09-29 13:24 UTC (History)
7 users (show)

Fixed In Version: Drupal 7.34
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2015-01-05 11:24:56 UTC
Embargoed:

Attachments (Terms of Use)

Description Vasyl Kaigorodov 2014-11-20 16:26:39 UTC 
Latest Drupal advisory [1] fixes denial of service vulnerability.
Drupal 7 includes a password hashing API to ensure that user supplied passwords are not stored in plain text.

A vulnerability in this API allows an attacker to send specially crafted requests resulting in CPU and memory exhaustion. This may lead to the site becoming unavailable or unresponsive (denial of service).

This vulnerability can be exploited by anonymous users.

[1]: https://www.drupal.org/SA-CORE-2014-006
Comment 1 Vasyl Kaigorodov 2014-11-20 16:29:49 UTC 
Created drupal7 tracking bugs for this issue:

Affects: fedora-all [bug 1166256]
Affects: epel-all [bug 1166257]
Comment 2 Fedora Update System 2014-12-03 01:03:37 UTC 
drupal7-7.34-1.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 3 Fedora Update System 2014-12-03 01:05:34 UTC 
drupal7-7.34-1.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 4 Fedora Update System 2014-12-06 10:05:16 UTC 
drupal7-7.34-1.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 5 Fedora Update System 2014-12-11 06:26:43 UTC 
drupal7-7.34-1.el6 has been pushed to the Fedora EPEL 6 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 6 Fedora Update System 2014-12-11 06:28:09 UTC 
drupal7-7.34-1.el7 has been pushed to the Fedora EPEL 7 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 7 Fedora Update System 2014-12-11 06:31:38 UTC 
drupal7-7.34-1.el5 has been pushed to the Fedora EPEL 5 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 8 Shawn Iwinski 2015-01-03 05:02:30 UTC 
All dependent bugs have been addressed and closed.  Can this bug be closed?
Comment 9 Vasyl Kaigorodov 2015-01-05 11:24:56 UTC 
(In reply to Shawn Iwinski from comment #8)
> All dependent bugs have been addressed and closed.  Can this bug be closed?

Yes, setting CLOSED/ERRATA here.
Note You need to log in before you can comment on or make changes to this bug.