CVE-2012-5371 Denial of service in n/a

What is CVE-2012-5371?

CVE-2012-5371 is a medium-severity denial of service vulnerability in Ruby-Lang Ruby, published on 28 Nov 2012. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Ruby (aka CRuby) 1.9 before 1.9.3-p327 and 2.0 before r37575 computes hash values without properly restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table, as demonstrated by a universal multicollision attack against a variant of the MurmurHash2 algorithm, a different vulnerability than CVE-2011-4815.

Weakness: CWE-310

Which versions are affected by CVE-2012-5371?

It affects 1 product.

Products include Ruby-Lang Ruby.

How do I fix CVE-2012-5371?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2012-5371 being exploited?

There is no known exploitation of CVE-2012-5371 in the wild and no public exploit code.

Other vulnerabilities in Ruby-Lang Ruby

• CVE-2009-4124 Memory corruption in n/a Critical 10.0
• CVE-2022-28738 Use after free in n/a Critical 9.8
• CVE-2011-4121 Weak cryptography in OpenSSL extension of Ruby (Git trunk) Critical 9.8
• CVE-2017-17790 Command injection in n/a Critical 9.8
• CVE-2017-11465 Memory corruption in n/a Critical 9.8

All Ruby-Lang Ruby vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as CVE-2011-5371, GHSA-phrv-cj28-9h57.