CVE-2012-1150: Medium severity Python Python vulnerability
Julian Wälde and Alexander Klink reported a flaw in the hash function used in the implementation of the Python dictionaries (associative arrays).
A specially-crafted set of keys could trigger hash function collisions, which degrade dictionary performance by changing hash table operations complexity from an expected/average O(1) to the worst case O(n). Reporters were able to find colliding strings efficiently using meet in the middle attack.
As various web application frameworks for Python automatically pre-fill certain dictionaries with data from the HTTP request (such as GET or POST parameters) for Python web application, a remote attacker could use this flaw to make Python interpreter use excessive amount of CPU time by sending a POST request with large amount of parameters which hash to the same value.
This problem is similar to the issue that was previously reported for and fixed in e.g. perl: http://www.cs.rice.edu/~scrosby/hash/CrosbyWallachUsenixSec2003.pdf
Other sources
Python before 2.6.8, 2.7.x before 2.7.3, 3.x before 3.1.5, and 3.2.x before 3.2.3 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table.
— Launchpad
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2012-1150?
CVE-2012-1150 has been classified as a moderate severity vulnerability due to its potential to degrade dictionary performance in Python.
How do I fix CVE-2012-1150?
To fix CVE-2012-1150, update to a patched version of Python, specifically versions 2.7.18-8+deb11u1 or later.
What are the affected versions of Python for CVE-2012-1150?
CVE-2012-1150 affects Python versions prior to 2.7.18 and includes multiple earlier versions such as 2.6.7 and 3.1.x.
What type of vulnerability is CVE-2012-1150?
CVE-2012-1150 is a denial-of-service vulnerability due to hash collisions that impact performance.
Can CVE-2012-1150 allow for remote code execution?
No, CVE-2012-1150 does not allow for remote code execution but solely affects the performance of dictionary operations.