7.5
CVE-2016-20013
- EPSS 0.31%
- Veröffentlicht 19.02.2022 05:15:09
- Zuletzt bearbeitet 21.11.2024 02:47:33
- Quelle cve@mitre.org
- CVE-Watchlists
- Unerledigt
Loginsha256crypt and sha512crypt through 0.6 allow attackers to cause a denial of service (CPU consumption) because the algorithm's runtime is proportional to the square of the length of the password.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Sha256crypt Project ≫ Sha256crypt Version <= 0.6
Sha512crypt Project ≫ Sha512crypt Version <= 0.6
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.31% | 0.535 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 7.5 | 3.9 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
|
| nvd@nist.gov | 5 | 10 | 2.9 |
AV:N/AC:L/Au:N/C:N/I:N/A:P
|
CWE-770 Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.