CVE-2012-0845

Published: Oct 5, 2012Modified: Apr 29, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

SimpleXMLRPCServer.py in SimpleXMLRPCServer in Python before 2.6.8, 2.7.x before 2.7.3, 3.x before 3.1.5, and 3.2.x before 3.2.3 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via an XML-RPC POST request that contains a smaller amount of data than specified by the Content-Length header.

Affected (58)

Products: Python: Python

1 product

Configuration A

43 vulnerable

Vulnerable Software	Affected Versions
Python Python	Up to 2.6.7
Python Python	Version 0.9.0
Python Python	Version 0.9.1
Python Python	Version 1.2
Python Python	Version 1.3
Python Python	Version 1.5.2
Python Python	Version 1.6.1
Python Python	Version 1.6
Python Python	Version 2.0.1
Python Python	Version 2.0
Python Python	Version 2.1.1
Python Python	Version 2.1.2
Python Python	Version 2.1.3
Python Python	Version 2.1
Python Python	Version 2.2.1
Python Python	Version 2.2.2
Python Python	Version 2.2.3
Python Python	Version 2.2
Python Python	Version 2.3.1
Python Python	Version 2.3.2
Python Python	Version 2.3.3
Python Python	Version 2.3.4
Python Python	Version 2.3.5
Python Python	Version 2.3.7
Python Python	Version 2.4.1
Python Python	Version 2.4.2
Python Python	Version 2.4.3
Python Python	Version 2.4.4
Python Python	Version 2.4.6
Python Python	Version 2.5.150
Python Python	Version 2.5.1
Python Python	Version 2.5.2
Python Python	Version 2.5.3
Python Python	Version 2.5.4
Python Python	Version 2.5.6
Python Python	Version 2.6.1
Python Python	Version 2.6.2150
Python Python	Version 2.6.2
Python Python	Version 2.6.3
Python Python	Version 2.6.4
Python Python	Version 2.6.5
Python Python	Version 2.6.6150
Python Python	Version 2.6.6

Configuration B

5 vulnerable

Vulnerable Software	Affected Versions
Python Python	Version 2.7.1150
Python Python	Version 2.7.1
Python Python	Version 2.7.1 rc1
Python Python	Version 2.7.2150
Python Python	Version 2.7.2 rc1

Configuration C

7 vulnerable

Vulnerable Software	Affected Versions
Python Python	Version 3.0.1
Python Python	Version 3.0
Python Python	Version 3.1.1
Python Python	Version 3.1.2
Python Python	Version 3.1.3
Python Python	Version 3.1.4
Python Python	Version 3.1

Configuration D

3 vulnerable

Vulnerable Software	Affected Versions
Python Python	Version 3.2.2150
Python Python	Version 3.2
Python Python	Version 3.2 alpha

Related CWEs

References (42)

http://bugs.python.org/issue14001

Source: secalert@redhat.com

Exploit

http://lists.apple.com/archives/security-announce/2013/Oct/msg00004.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html

Source: secalert@redhat.com

http://python.org/download/releases/2.6.8/

Source: secalert@redhat.com

PatchVendor Advisory

http://python.org/download/releases/2.7.3/

Source: secalert@redhat.com

PatchVendor Advisory

http://python.org/download/releases/3.1.5/

Source: secalert@redhat.com

PatchVendor Advisory

http://python.org/download/releases/3.2.3/

Source: secalert@redhat.com

PatchVendor Advisory

http://secunia.com/advisories/50858

Source: secalert@redhat.com

http://secunia.com/advisories/51024

Source: secalert@redhat.com

http://secunia.com/advisories/51040

Source: secalert@redhat.com

http://secunia.com/advisories/51087

Source: secalert@redhat.com

http://secunia.com/advisories/51089

Source: secalert@redhat.com

http://www.openwall.com/lists/oss-security/2012/02/13/4

Source: secalert@redhat.com

http://www.securitytracker.com/id?1026689

Source: secalert@redhat.com

http://www.ubuntu.com/usn/USN-1592-1

Source: secalert@redhat.com

http://www.ubuntu.com/usn/USN-1596-1

Source: secalert@redhat.com

http://www.ubuntu.com/usn/USN-1613-1

Source: secalert@redhat.com

http://www.ubuntu.com/usn/USN-1613-2

Source: secalert@redhat.com

http://www.ubuntu.com/usn/USN-1615-1

Source: secalert@redhat.com

http://www.ubuntu.com/usn/USN-1616-1

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=789790

Source: secalert@redhat.com

http://bugs.python.org/issue14001

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

http://lists.apple.com/archives/security-announce/2013/Oct/msg00004.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://python.org/download/releases/2.6.8/

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

http://python.org/download/releases/2.7.3/

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

http://python.org/download/releases/3.1.5/

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

http://python.org/download/releases/3.2.3/

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

http://secunia.com/advisories/50858

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/51024

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/51040

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/51087

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/51089

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2012/02/13/4

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securitytracker.com/id?1026689

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.ubuntu.com/usn/USN-1592-1

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.ubuntu.com/usn/USN-1596-1

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.ubuntu.com/usn/USN-1613-1

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.ubuntu.com/usn/USN-1613-2

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.ubuntu.com/usn/USN-1615-1

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.ubuntu.com/usn/USN-1616-1

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugzilla.redhat.com/show_bug.cgi?id=789790

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.