PT-2011-5137 · Jruby · Jruby

Alexander Klink + 1 · Publicado 2011-12-30 · Atualizado 2021-01-12 · CVE-2011-4838

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions JRuby versions prior to 1.6.5.1

Description The issue allows context-dependent attackers to cause a denial of service, specifically CPU consumption, via crafted input to an application that maintains a hash table. This is due to the computation of hash values without restricting the ability to trigger hash collisions predictably.

Recommendations For versions prior to 1.6.5.1, update to version 1.6.5.1 or later to resolve the issue.

Correção

Resource Exhaustion

Enumeração de Fraquezas

CWE-400

Identificadores relacionados

CVE-2011-4838

DLA-209-1

Produtos afetados

Jruby

Referências · 15

• http://ocert.org/advisories/ocert-2011-003.html · Nota
• https://osv.dev/vulnerability/CVE-2011-4838 · Aviso do Fabricante
• http://rhn.redhat.com/errata/RHSA-2012-1232.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2011-4838 · Nota de Segurança
• http://security.gentoo.org/glsa/glsa-201207-06.xml · Aviso do Fabricante
• http://secunia.com/advisories/50084 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/72019 · Nota
• http://secunia.com/advisories/47407 · Nota
• http://jruby.org/2011/12/27/jruby-1-6-5-1.html · Aviso do Fabricante
• http://archives.neohapsis.com/archives/bugtraq/2011-12/0181.html · Nota
• https://security-tracker.debian.org/tracker/CVE-2011-4838 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-4838 · Aviso do Fabricante
• https://t.me/cvenotify/8437 · Publicação no Telegram
• http://nruns.com/_downloads/advisory28122011.pdf · Nota
• http://kb.cert.org/vuls/id/903934 · Nota