CPython hash secret can be recoved remotely

[Nick Coghlan <ncoghlan () redhat com>]

Software: CPython
Vendor: Python Software Foundation
Vulnerability: remote target-specific CPU usage DOS

This is a followup to CVE-2012-1150 (hash table collision CPU usage DOS
in CPython)

http://bugs.python.org/issue14621 points out that the hash secret in
CPython can be recovered remotely, so while the original fix addressed
the "blind DOS" problem (of being able to DOS any Python based service
with a single prepared payload), it didn't completely eliminate the
potential for remote DOS attacks based on hash collisions.
(http://bugs.python.org/issue14621#msg173455 has the details)

Python 3.4+ will use SipHash by default
(http://www.python.org/dev/peps/pep-0456), which should resolve the
vulnerability completely.

Regards,
Nick.

-- 
Nick Coghlan
Red Hat Hosted & Shared Services
Software Engineering & Development, Brisbane

Testing Solutions Team Lead
Beaker Development Lead (http://beaker-project.org/)