[Python-Dev] Python Remote Code Execution in socket.recvfrom_into()

[Donald Stufft]

On Feb 25, 2014, at 8:06 AM, Chris Angelico <rosuav at gmail.com> wrote:

> On Tue, Feb 25, 2014 at 11:59 PM, Maciej Fijalkowski <fijall at gmail.com> wrote:
>>> Last issues:
>>> - hash DoS
>> 
>> is this fixed?
> 
> Yes, hash randomization was added as an option in 2.7.3 or 2.7.4 or
> thereabouts, and is on by default in 3.3+. You do have to set an
> environment variable for 2.7 (and I think 2.6 got that too (??)), as
> it can break code.
> 
> ChrisA
> _______________________________________________
> Python-Dev mailing list
> Python-Dev at python.org
> https://mail.python.org/mailman/listinfo/python-dev
> Unsubscribe: https://mail.python.org/mailman/options/python-dev/donald%40stufft.io

Hash randomization is broken and doesn’t fix anything. It’s only SipHash in 3.4+ that actually fixes it.

-----------------
Donald Stufft
PGP: 0x6E3CBCE93372DCFA // 7C6B 7C5D 5E2B 6356 A926 F04F 6E3C BCE9 3372 DCFA

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 801 bytes
Desc: Message signed with OpenPGP using GPGMail
URL: <http://mail.python.org/pipermail/python-dev/attachments/20140225/7012a961/attachment.sig>