Advisory details:
ubuntu_osv / UBUNTU-CVE-2014-9016
| Advisory ID | ubuntu_osv/UBUNTU-CVE-2014-9016 |
| Aliases |
CVE-2014-9016
|
| Summary | The password hashing API in Drupal 7.x before 7.34 and the Secure Password Hashes (aka phpass) module 6.x-2.x before 6.x-2.1 for Drupal allows remote attackers to cause a denial of service (CPU and memory consumption) via a crafted request. |
| Status | Published |
| Exploitability | 2.0 |
| Weighted Severity | 6.2 |
| Risk | 10.0 |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| There are no known CWE. |
| System | Score | Found at |
|---|---|---|
| ubuntu-priority | medium | https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2014/UBUNTU-CVE-2014-9016.json |
| Reference id | Reference type | URL |
|---|---|---|
| https://ubuntu.com/security/CVE-2014-9016 | ||
| https://www.cve.org/CVERecord?id=CVE-2014-9016 | ||
| https://www.drupal.org/SA-CORE-2014-006 |
| Data source | Exploit-DB |
|---|---|
| Date added | Dec. 1, 2014 |
| Description | Drupal < 7.34 - Denial of Service |
| Ransomware campaign use | Unknown |
| Source publication date | Dec. 1, 2014 |
| Exploit type | dos |
| Platform | php |
| Source update date | Dec. 1, 2014 |
| Data source | Metasploit |
|---|---|
| Description | WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to cause a denial of service (CPU consumption) via a long password that is improperly handled during hashing. |
| Note | Stability: - crash-service-down SideEffects: [] Reliability: [] |
| Ransomware campaign use | Unknown |
| Source publication date | Nov. 20, 2014 |
| Source URL | https://github.com/rapid7/metasploit-framework/tree/master/modules/auxiliary/dos/http/wordpress_long_password_dos.rb |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
There are no SSVC decisions available.