PT-2012-5954 · Jruby · Jruby

David Jorm + 1 · Publicado 2012-11-28 · Atualizado 2022-05-17 · CVE-2012-5370

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions JRuby (affected versions not specified)

Description The issue allows context-dependent attackers to cause a denial of service, specifically CPU consumption, by providing crafted input to an application that uses a hash table. This is demonstrated through a universal multicollision attack against the MurmurHash2 algorithm.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Resource Exhaustion

Enumeração de Fraquezas

CWE-400

CWE-310

Identificadores relacionados

CVE-2012-5370

DLA-209-1

GHSA-FMMQ-J7PQ-F85C

Produtos afetados

Jruby

Referências · 13

• https://github.com/jruby/jruby/commit/5e4aab28b26fd127112b76fabfac9a33b64caf77 · Nota
• http://rhn.redhat.com/errata/RHSA-2013-0533.html · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2012-5370 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-5370 · Aviso do Fabricante
• http://2012.appsec-forum.ch/conferences/#c17 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=880671 · Nota
• https://osv.dev/vulnerability/CVE-2012-5370 · Aviso do Fabricante
• https://131002.net/data/talks/appsec12_slides.pdf · Nota
• https://osv.dev/vulnerability/GHSA-fmmq-j7pq-f85c · Aviso do Fabricante
• http://asfws12.files.wordpress.com/2012/11/asfws2012-jean_philippe_aumasson-martin_bosslet-hash_flooding_dos_reloaded.pdf · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-5370 · Nota de Segurança
• http://jruby.org/2012/12/03/jruby-1-7-1 · Nota
• http://ocert.org/advisories/ocert-2012-001.html · Nota