[Deestan]

Yes. This is a trivial exploit of a designed weakness in hashtables.

I shall, arrogant as I am, scoff at people who are surprised when this happens. I mean, honestly, what kind of developer doesn't know the basic properties of their data structures?

[mdwrigh2]

Well, this isn't exploitable if you use a randomized hash function like Ruby 1.9 does.

See http://www.ocert.org/advisories/ocert-2011-003.html for a listing of vulnerable languages (and yes, Python is on the list).

[chc]

You make it sound like you're somehow disagreeing with him, but what he says is true even of Ruby's hash algorithm. Introducing randomness into the hash function is really just a band-aid on this vulnerability. The inherent vulnerability is there either way; you just need a bit of runtime information to do the attack when runtime information is introduced into the hash function.

[zerothehero]

I meant actually give code for the exploit.