CVE

Id
58613  
CVE No.
CVE-2012-5370  
Status
Candidate  
Description
JRuby computes hash values without properly restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table, as demonstrated by a universal multicollision attack against the MurmurHash2 algorithm, a different vulnerability than CVE-2011-4838.  
Phase
Assigned (20121010)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
600576 58613 CVE-2012-5370 MISC:http://2012.appsec-forum.ch/conferences/#c17  View
600577 58613 CVE-2012-5370 MISC:http://asfws12.files.wordpress.com/2012/11/asfws2012-jean_philippe_aumasson-martin_bosslet-hash_flooding_dos_reloaded.pdf  View
600578 58613 CVE-2012-5370 MISC:http://www.ocert.org/advisories/ocert-2012-001.html  View
600579 58613 CVE-2012-5370 MISC:https://www.131002.net/data/talks/appsec12_slides.pdf  View
600580 58613 CVE-2012-5370 CONFIRM:https://bugzilla.redhat.com/show_bug.cgi?id=880671  View
600581 58613 CVE-2012-5370 REDHAT:RHSA-2013:0533  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
20027 JVNDB-2013-001602 Linux Kernel の Btrfs の実装におけるサービス運用妨害 (DoS) の脆弱性 Linux Kernel の Btrfs の実装の CRC32C 機能には、サービス運用妨害 (ファイル生成の抑止) 状態となる脆弱性が存在します。 CVE-2012-5375 58613 4 http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-001602.html  View