CVE

Id
58614  
CVE No.
CVE-2012-5371  
Status
Candidate  
Description
Ruby (aka CRuby) 1.9 before 1.9.3-p327 and 2.0 before r37575 computes hash values without properly restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table, as demonstrated by a universal multicollision attack against a variant of the MurmurHash2 algorithm, a different vulnerability than CVE-2011-4815.  
Phase
Assigned (20121010)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
600582 58614 CVE-2012-5371 MISC:http://2012.appsec-forum.ch/conferences/#c17  View
600583 58614 CVE-2012-5371 MISC:http://asfws12.files.wordpress.com/2012/11/asfws2012-jean_philippe_aumasson-martin_bosslet-hash_flooding_dos_reloaded.pdf  View
600584 58614 CVE-2012-5371 MISC:http://www.ocert.org/advisories/ocert-2012-001.html  View
600585 58614 CVE-2012-5371 MISC:https://www.131002.net/data/talks/appsec12_slides.pdf  View
600586 58614 CVE-2012-5371 CONFIRM:http://www.ruby-lang.org/en/news/2012/11/09/ruby19-hashdos-cve-2012-5371/  View
600587 58614 CVE-2012-5371 CONFIRM:https://bugzilla.redhat.com/show_bug.cgi?id=875236  View
600588 58614 CVE-2012-5371 UBUNTU:USN-1733-1  View
600589 58614 CVE-2012-5371 URL:http://www.ubuntu.com/usn/USN-1733-1  View
600590 58614 CVE-2012-5371 BID:56484  View
600591 58614 CVE-2012-5371 URL:http://www.securityfocus.com/bid/56484  View
600592 58614 CVE-2012-5371 OSVDB:87280  View
600593 58614 CVE-2012-5371 URL:http://www.osvdb.org/87280  View
600594 58614 CVE-2012-5371 SECTRACK:1027747  View
600595 58614 CVE-2012-5371 URL:http://securitytracker.com/id?1027747  View
600596 58614 CVE-2012-5371 SECUNIA:51253  View
600597 58614 CVE-2012-5371 URL:http://secunia.com/advisories/51253  View
600598 58614 CVE-2012-5371 XF:ruby-hash-function-dos(79993)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
29212 JVNDB-2012-004919 Google Chrome のプロセス間通信の実装におけるサンドボックスの制限を回避される脆弱性 Google Chrome のプロセス間通信 (IPC) の実装には、サンドボックスの制限を回避され、任意のファイルに書き込まれる脆弱性が存在します。 CVE-2012-5376 58614 10 http://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-004919.html  View