CVE-2012-5371

2012-11-2813:03:00

CWE-310

[email protected]

web.nvd.nist.gov

cve-2012-5371

ruby

cruby

hash collision

denial of service

cpu consumption

nvd

6.2 Medium

AI Score

Confidence

Low

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.006 Low

EPSS

Percentile

77.6%

JSON

Ruby (aka CRuby) 1.9 before 1.9.3-p327 and 2.0 before r37575 computes hash values without properly restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table, as demonstrated by a universal multicollision attack against a variant of the MurmurHash2 algorithm, a different vulnerability than CVE-2011-4815.

CPENameOperatorVersion
ruby-lang:rubyruby-lang rubyeq2.0
ruby-lang:rubyruby-lang rubyeq1.9.2
ruby-lang:rubyruby-lang rubyeq1.9.1
ruby-lang:rubyruby-lang rubyeq1.9.3
ruby-lang:rubyruby-lang rubyeq1.9

CPE	Name	Operator	Version
ruby-lang:ruby	ruby-lang ruby	eq	2.0
ruby-lang:ruby	ruby-lang ruby	eq	1.9.2
ruby-lang:ruby	ruby-lang ruby	eq	1.9.1
ruby-lang:ruby	ruby-lang ruby	eq	1.9.3
ruby-lang:ruby	ruby-lang ruby	eq	1.9