Is there an exploit for python hash collision?

Is it really unclear? I mean, there is a link to vulnerability description and a question IS THERE AN EXPLOIT FOR THIS????????!. How is it possible one could not get it?


It is unclear - and the comment below the question explains exactly why. If you want a question answered, please make it straightforward for those who volunteer their time to answer it.

Also, 15 of your 20 questions on the main site and meta (including this one) fail to meet requirements so have been closed or migrated. This indicates you are not paying any attention to the site guidelines - which I and others have pointed you towards.

At best, this will make people less likely to answer your questions, at worst you may get suspended or have an automated hold put on you asking any more questions.

Please re-read it - and next time you ask a question, check to see if it is in scope, structured correctly, and hasn't been answered before.

  • WHAT exactly is unclear? An answer proofs that there was at least one person that has understood it. – Smit Johnth Apr 25 '15 at 3:56
  • 2
    @SmitJohnth First off, you link to off-site content. You should copy the relevant content as a block quote and use the link as a source reference. (If the link dies, so does your stackexchange question.) Second, what do you mean exactly by "exploit?" If you had asked, "is there an active metasploit module" or "are there active exploits detected in the wild?" the question wouldn't be in the negative zone. Your last two sentences don't even make sense. If you're not going to take the time to clearly communicate, why should I spend time interpreting/answering your question? – avgvstvs Apr 29 '15 at 3:40
  • @avgvstvs if the cve entry dies then my question isn't actual anymore, yes. Exploit is defined as a program which lets exploit some vulnerability. For me, it's clear what I'm asking - is it unclear for you or you just want something else? – Smit Johnth May 3 '15 at 18:27
  • 4
    @SmitJohnth Assume that the links you posted are already broken. Now read your question. Is it clear? You should summarize just enough of the offsite content that someone can answer your question without clicking out of this site. – avgvstvs May 3 '15 at 19:25

Since the question in the comments keeps coming up as "What is it you want," I'm going to extract my comment into an answer here:

Assume that the links you posted are already broken. Now read your question. Is it clear? You should summarize just enough of the offsite content that someone can answer your question without clicking out of this site.

Taking that assumption to heart, this is how you need to think about your questions. Your unedited question was just this:

Is there an exploit for this vulnerability?

Like I said, assume the links you add are already dead. They're only there for historical references. This is a meaningless question.

Later @schroeder added this in an edit:


Python DoS via hash algorithm collision - oCERT advisory 2011-003. Affected numerous languages. No CVE for Python but CVEs for other languages.

Again, assume your link is dead. Now whoever's going to answer this question is going to have to go google what the heck "CERT advisory 2011-003" is and hope that they can stumble across something.

You're putting more work on the answerer than the community deems necessary. Its entirely reasonable for a question like this to go unanswerable for a few years, because you're asking "is there an active exploit," which means your question is "NO" until suddenly "YES." Which is another problem with the question.

This is more what your question should look like:


From this site, multiple languages were specified in a security bulletin including Python:

The condition for predictable collisions in the hashing functions has been reported for the following language implementations: Java, JRuby, PHP, Python, Rubinius, Ruby. In the case of the Ruby language, the 1.9.x branch is not affected by the predictable collision condition since this version includes a randomization of the hashing function.

Here were the CVEs listed:

CVE-2011-5034 (Apache Geronimo), 
CVE-2011-5035 (Oracle Glassfish), 
CVE-2011-4461 (Jetty), 
CVE-2011-4838 (JRuby), 
CVE-2011-4885 (PHP), 
CVE-2011-4462 (Plone), 
CVE-2011-5036 (Rack), 
CVE-2011-4815 (Ruby), 
CVE-2011-4858 (Apache Tomcat), 
CVE-2011-5037 (V8 JavaScript Engine)

Python was listed in the CERT message as shown here, but there was no corresponding CVE written for Python. Did this fall through the cracks? Was there a python patch related to this bulletin?


This hypothetical version of the question at least lets someone go, download the python code repo and search for commits that were time-correlated to the bulletin in question. In the best-case, your current form asks "is there an active exploit" which is open-ended: The answer might be NO today, but might be YES later, and what if you accepted an answer that was right today, and that answer goes wrong years from now after you're working as a CEO and don't need this site anymore? Part of using this site is caring for its future state.

If you really want to ask the question in the form you started out with, it isn't appropriate for this site, and I would suggest the fulldisclosure mailing list, and ask the question a couple times a year.

  • 2
    actually, I added the edit and the link oCERT to provide SOME sort of relevance. I was hoping the OP would use that as an indicator of the type of enhancements the question needed. – schroeder May 7 '15 at 18:04
  • @schroeder My fault for not checking the history. Sorry about the mis-attribution. – avgvstvs May 9 '15 at 4:20

As Rory pointed out, the comment in response to your question is fairly specific: you need to include the details of the CVE in the question itself, not merely link to it. On the one hand, is the desire to create and maintain the SE sites as the resource for information, not merely a repository of links to other sites. On the other hand, you're asking for other people's time in answering your question. It is in your interest to make it easy for them to do so by making the question itself complete and not requiring others to go to other sites and research the details of what you're asking.

  • Would people be happier if I copy-paste the CVE instead of giving link to it? Again for the argument "people spend time on me": they do it on every free internet forum,but nobody complains there that "they should click links" – Smit Johnth Apr 26 '15 at 12:55
  • 4
    I think the general principle is that the best questions should be complete and should stand on their own, without requiring external references. – Allen Apr 26 '15 at 20:12
  • It's not a problem for me to copypaste the whole internet - the question is, is it what you really want? – Smit Johnth May 3 '15 at 18:27
  • 3
    Smit - have a good look round the other questions. Have a good read of our tour page and How to Ask page. If you are expecting other people to happily figure out what you want and trek through a bunch of google searches/links then maybe those free internet forums are where you should ask the question. For you to get answers here, there is a minimum standard you need to reach. – Rory Alsop May 3 '15 at 19:36
  • @RoryAlsop you (SE, and especially sec.se) are simply overeated. There are simply too much people joining SE - and you start to touch grub, don't you think. Every time you want more and more, more and more, close questions with little and little till no reason, demand more and more, more and more. Have you ever read Pushkin's "The Tale of the Fisherman and the Fish" or similar fairy tale? No? How about you write questions and answer them by yourself? – Smit Johnth May 4 '15 at 1:21
  • 2
    Smit - if that is your opinion, and you feel Security.SE is over-rated please feel free to go elsewhere. Continuing your generally disparaging comments, and failure to follow the rules, will just earn you a suspension. – Rory Alsop May 4 '15 at 1:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .