VDB
CVE-2016-20013
CVE-2016-20013
PUBLISHED
CVSS 7.5 HIGH
sha256crypt and sha512crypt through 0.6 allow attackers to cause a denial of service (CPU consumption) because the algorithm's runtime is proportional to the square of the length of the password.
EPSS 2.17% · 82.3th percentile
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score
2.17%
82.3th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ubuntu:16.04:LTS | syslinux | 0, 3:6.03+dfsg-8ubuntu2, 3:6.03+dfsg-11ubuntu1 |
| Ubuntu:Pro:18.04:LTS | zabbix | 1:3.0.12+dfsg-1ubuntu0.1~esm1, 1:3.0.12+dfsg-1ubuntu0.1~esm4, 1:3.0.12+dfsg-1 |
| Ubuntu:24.04:LTS | dietlibc | 0.34~cvs20160606-14, 0 |
| Ubuntu:18.04:LTS | sssd | 1.16.0-5ubuntu2, 0, 1.15.3-3ubuntu1 |
| Ubuntu:16.04:LTS | sssd | 1.13.4-1ubuntu1.11, 1.13.4-1ubuntu1.7, 1.13.4-1ubuntu1.6 |
| Ubuntu:22.04:LTS | syslinux | 0, 3:6.04~git20190206.bf6db5b4+dfsg1-3ubuntu1 |
| Ubuntu:24.04:LTS | sssd | 2.9.4-1.1ubuntu3, 2.9.4-1.1ubuntu6.3, 2.9.4-1.1ubuntu6.2 |
| Ubuntu:14.04:LTS | syslinux | 3:4.05+dfsg-6+deb7u3ubuntu1, 0 |
| Ubuntu:Pro:14.04:LTS | eglibc | 2.19-0ubuntu6.9, 2.19-0ubuntu6.8, 2.19-0ubuntu6.6 |
| Ubuntu:16.04:LTS | dietlibc | 0.33~cvs20120325-6, 0.33~cvs20120325-6+deb8u1build0.16.04.1, 0 |
| Ubuntu:22.04:LTS | zabbix | 1:5.0.17+dfsg-1, 0, 1:5.0.8+dfsg-1build1 |
| Ubuntu:20.04:LTS | syslinux-legacy | 0, 2:3.63+dfsg-2ubuntu9 |
| Ubuntu:Pro:16.04:LTS | glibc | 2.23-0ubuntu1, 2.23-0ubuntu11.3+esm7, 2.21-0ubuntu4 |
| Ubuntu:18.04:LTS | syslinux-legacy | 0, 2:3.63+dfsg-2ubuntu9 |
| Ubuntu:22.04:LTS | glibc | 2.35-0ubuntu1, 0, 2.35-0ubuntu3.11 |
| Ubuntu:18.04:LTS | dietlibc | 0, 0.34~cvs20160606-7 |
| Ubuntu:Pro:16.04:LTS | zabbix | 1:2.4.7+dfsg-2ubuntu2.1+esm1, 1:2.4.7+dfsg-2ubuntu2.1+esm2, 1:2.4.7+dfsg-2ubuntu2.1+esm3 |
| Ubuntu:Pro:20.04:LTS | glibc | 2.31-0ubuntu9.9, 2.31-0ubuntu9.12, 2.31-0ubuntu9.16 |
| Ubuntu:20.04:LTS | dietlibc | 0, 0.34~cvs20160606-12, 0.34~cvs20160606-10 |
| Ubuntu:Pro:18.04:LTS | glibc | 2.27-3ubuntu1.6+esm2, 2.27-3ubuntu1.6, 2.27-3ubuntu1 |
…and 10 more
Timeline
- Feb 19, 2022 EPSS Score
- Feb 19, 2022 CVE Published
- Apr 13, 2022 EPSS Score
- Jun 4, 2022 EPSS Score
- Jul 28, 2022 EPSS Score
- Sep 19, 2022 EPSS Score
- Nov 10, 2022 EPSS Score
- Jan 2, 2023 EPSS Score
- Feb 24, 2023 EPSS Score
- Apr 17, 2023 EPSS Score
- Jun 9, 2023 EPSS Score
- Aug 1, 2023 EPSS Score
References
- https://akkadia.org/drepper/SHA-crypt.txt third-party-advisory
- https://pthree.org/2018/05/23/do-not-use-sha256crypt-sha512crypt-theyre-dangerous/ third-party-advisory
- https://twitter.com/solardiz/status/795601240151457793 third-party-advisory
- https://www.cve.org/CVERecord?id=CVE-2016-20013 third-party-advisory
- https://ubuntu.com/security/CVE-2016-20013 advisory