CVE-2014-9016

Published: Nov 24, 2014Modified: May 6, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

The password hashing API in Drupal 7.x before 7.34 and the Secure Password Hashes (aka phpass) module 6.x-2.x before 6.x-2.1 for Drupal allows remote attackers to cause a denial of service (CPU and memory consumption) via a crafted request.

Affected (3)

Products: Drupal: Drupal · Secure Password Hashes Project: Secure Passwords Hashes · Debian: Debian Linux

Drupal

1 product

Drupal

Secure Password Hashes Project

1 product

Secure Passwords Hashes

Debian

1 product

Debian Linux

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Drupal Drupal	From 7.0 to 7.34
Secure Password Hashes Project Secure Passwords Hashes	From 6.x-2.0 to 6.x-2.1

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 7.0

References (18)

http://secunia.com/advisories/59164

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/59814

Source: cve@mitre.org

Third Party Advisory

http://www.debian.org/security/2014/dsa-3075

Source: cve@mitre.org

Third Party Advisory

http://www.openwall.com/lists/oss-security/2014/11/20/21

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2014/11/20/3

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2014/11/21/1

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://www.drupal.org/SA-CORE-2014-006

Source: cve@mitre.org

Vendor Advisory

https://www.drupal.org/node/2378367

Source: cve@mitre.org

PatchVendor Advisory

https://www.drupal.org/node/2378375

Source: cve@mitre.org

PatchVendor Advisory

http://secunia.com/advisories/59164