Lucene search

K
freebsdFreeBSD68C1F75B-8824-11E2-9996-C48508086173
HistoryMar 04, 2013 - 12:00 a.m.

perl -- denial of service via algorithmic complexity attack on hashing routines

2013-03-0400:00:00
vuxml.freebsd.org
15

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.018 Low

EPSS

Percentile

88.2%

Perl developers report:

In order to prevent an algorithmic complexity attack
against its hashing mechanism, perl will sometimes
recalculate keys and redistribute the contents of a hash.
This mechanism has made perl robust against attacks that
have been demonstrated against other systems.
Research by Yves Orton has recently uncovered a flaw in
the rehashing code which can result in pathological
behavior. This flaw could be exploited to carry out a
denial of service attack against code that uses arbitrary
user input as hash keys.
Because using user-provided strings as hash keys is a
very common operation, we urge users of perl to update their
perl executable as soon as possible.

OSVersionArchitecturePackageVersionFilename
FreeBSDanynoarchperl< 5.12.4_5UNKNOWN
FreeBSDanynoarchperl-threaded< 5.12.4_5UNKNOWN

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.018 Low

EPSS

Percentile

88.2%