Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.0
CVE-2014-9016: Drupal 7 before 7.34 can be slowed down by attackers
CVE-2014-9016 · published 11 years ago
Summary
The password handling code in Drupal 7 (versions earlier than 7.34) and the Secure Password Hashes module for Drupal (versions earlier than 6.x-2.1) can be tricked into using a lot of processor and memory resources. An attacker can send a specially crafted request that makes the web site consume excessive resources, potentially causing it to become unresponsive. Upgrade Drupal to version 7.34 or later and update the Secure Password Hashes module to 6.x-2.1 or newer to stop this behavior.
What to do
- Update drupal drupal to version 7.34 or later.
- Update secure_password_hashes_project secure_passwords_hashes to version 6.x-2.1 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| drupal | drupal |
>= 7.0, < 7.34 cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* |
| secure_password_hashes_project | secure_passwords_hashes |
>= 6.x-2.0, < 6.x-2.1 cpe:2.3:a:secure_password_hashes_project:secure_passwords_hashes:*:*:*:*:*:drupal:*:* |
| debian | debian_linux |
7.0 cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:* |
Original advisory text
The password hashing API in Drupal 7.x before 7.34 and the Secure Password Hashes (aka phpass) module 6.x-2.x before 6.x-2.1 for Drupal allows remote attackers to cause a denial of service (CPU and...
The password hashing API in Drupal 7.x before 7.34 and the Secure Password Hashes (aka phpass) module 6.x-2.x before 6.x-2.1 for Drupal allows remote attackers to cause a denial of service (CPU and memory consumption) via a crafted request.
References
- http://secunia.com/advisories/59164 Third Party Advisory
- http://secunia.com/advisories/59814 Third Party Advisory
- http://www.debian.org/security/2014/dsa-3075 Third Party Advisory
- http://www.openwall.com/lists/oss-security/2014/11/20/21 Mailing List Third Party Advisory
- http://www.openwall.com/lists/oss-security/2014/11/20/3 Mailing List Third Party Advisory
- http://www.openwall.com/lists/oss-security/2014/11/21/1 Mailing List Third Party Advisory
- https://www.drupal.org/SA-CORE-2014-006 Vendor Advisory
- https://www.drupal.org/node/2378367 Patch Vendor Advisory
- https://www.drupal.org/node/2378375 Patch Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Severity
5.0
Medium
Timeline
Published24 Nov 2014
Updated28 Oct 2026
First seen29 Sep 2026
Sources
CVE-2014-9016 · NVD
Track software like this
Free during beta