CVE-2012-5370 JRuby denial of service via Hash Collision
Attackers can cause denial of service via CPU exhaustion by triggering predictable hash collisions in JRuby applications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2012-5370?
CVE-2012-5370 is a medium-severity denial of service vulnerability in n/a, published on 28 Nov 2012. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
JRuby computes hash values without properly restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table, as demonstrated by a universal multicollision attack against the MurmurHash2 algorithm, a different vulnerability than CVE-2011-4838.
Weakness: CWE-310
Which versions are affected by CVE-2012-5370?
2 open source packages ship an affected version, including org.jruby:jruby-parent. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.jruby:jruby-parent Maven | All versions | 1.7.1 |
org.jruby:jruby-parent Maven | All versions | 1.7.1 |
Products include Jruby Jruby.
How do I fix CVE-2012-5370?
Upgrade org.jruby:jruby-parent to 1.7.1 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2012-5370 being exploited?
There is no known exploitation of CVE-2012-5370 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as CVE-2011-5370, DEBIAN-CVE-2012-5370, GHSA-fmmq-j7pq-f85c, MINI-gf2f-69g9-8477, MINI-j7hx-xm35-g2qx.