CVE-2014-9016

MEDIUM 5.0CVE-2014-9016 · Published 24/11/2014 · updated 17/06/2026

Package	Affected versions	Patched versions
drupal drupal	`≥ 7.0, < 7.34`	`7.34`
secure passwords hashes secure_password_hashes_project	`≥ 6.x-2.0, < 6.x-2.1`	`6.x-2.1`

Description

The password hashing API in Drupal 7.x before 7.34 and the Secure Password Hashes (aka phpass) module 6.x-2.x before 6.x-2.1 for Drupal allows remote attackers to cause a denial of service (CPU and memory consumption) via a crafted request.

References

secunia.com/advisories/59164 · Third Party Advisory
secunia.com/advisories/59814 · Third Party Advisory
debian.org/security/2014/dsa-3075 · Third Party Advisory
openwall.com/lists/oss-security/2014/11/20/21 · Mailing List
openwall.com/lists/oss-security/2014/11/20/3 · Mailing List
openwall.com/lists/oss-security/2014/11/21/1 · Mailing List
drupal.org/SA-CORE-2014-006 · Vendor Advisory
drupal.org/node/2378367 · Patch
drupal.org/node/2378375 · Patch

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free