NVD

Id
46554  
Name
CVE-2012-5370  
Description
JRuby computes hash values without properly restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table, as demonstrated by a universal multicollision attack against the MurmurHash2 algorithm, a different vulnerability than CVE-2011-4838.  
Reject
 
CVSS Version
2  
CVSS Score
5  
Severity
Medium  
CVSS Base Score
5  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:N/I:N/A:P)  
Pub Date
2017-01-19  
Published
2012-11-28  
Modified Date
2015-01-17  
Seq
2012-5370  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
233209 46554 CVE-2012-5370 http://2012.appsec-forum.ch/conferences/#c17  View
233210 46554 CVE-2012-5370 http://asfws12.files.wordpress.com/2012/11/asfws2012-jean_philippe_aumasson-martin_bosslet-hash_flooding_dos_reloaded.pdf  View
233211 46554 CVE-2012-5370 RHSA-2013:0533  View
233212 46554 CVE-2012-5370 http://www.ocert.org/advisories/ocert-2012-001.html  View
233213 46554 CVE-2012-5370 https://bugzilla.redhat.com/show_bug.cgi?id=880671  View
233214 46554 CVE-2012-5370 https://www.131002.net/data/talks/appsec12_slides.pdf  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
34959 JVNDB-2011-005201 JRuby におけるサービス運用妨害 (CPU 資源の消費) の脆弱性 JRuby は、ハッシュ衝突を想定した制限を適切に行わずにハッシュ値を算出するため、サービス運用妨害 (CPU 資源の消費) 状態となる脆弱性が存在します。 CVE-2012-5370 58608 CVE-2012-5370 46554 5 http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-005201.html 2011-11-28 2012-11-29 View