WordPress CVEs

Description

wp-includes/class-phpass.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to cause a denial of service (CPU consumption) via a long password that is improperly handled during hashing, a similar issue to CVE-2014-9016.

Affected WordPress components

• WordPress core
  Confirmed match
  Up to and including 3.7.4; Version 3.8; Version 3.8.1; Version 3.8.2; Version 3.8.3; Version 3.8.4; Version 3.9; Version 3.9.1; Version 3.9.2; Version 4.0

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• n/a n/a — Versions not specified
• wordpress wordpress — Up to and including 3.7.4
• wordpress wordpress — Version 3.8
• wordpress wordpress — Version 3.8.1
• wordpress wordpress — Version 3.8.2
• wordpress wordpress — Version 3.8.3
• wordpress wordpress — Version 3.8.4
• wordpress wordpress — Version 3.9
• wordpress wordpress — Version 3.9.1
• wordpress wordpress — Version 3.9.2
• wordpress wordpress — Version 4.0

References

• advisories.mageia.org http://advisories.mageia.org/MGASA-2014-0493.html
• core.trac.wordpress.org http://core.trac.wordpress.org/changeset/30467 Vendor Advisory
• openwall.com http://openwall.com/lists/oss-security/2014/11/25/12
• www.debian.org http://www.debian.org/security/2014/dsa-3085
• www.mandriva.com http://www.mandriva.com/security/advisories?name=MDVSA-2014:233
• www.securitytracker.com http://www.securitytracker.com/id/1031243
• wordpress.org https://wordpress.org/news/2014/11/wordpress-4-0-1/ Patch, Vendor Advisory
• nvd.nist.gov Official NVD record