[SECURITY] [DLA 209-1] jruby security update

2015-04-29T10:47:49
ID DEBIAN:DLA-209-1:3C908
Type debian
Reporter Debian
Modified 2015-04-29T10:47:49

Description

Package : jruby Version : 1.5.1-1+deb6u1 CVE ID : CVE-2011-4838 Debian Bug : 686867

JRuby before 1.6.5.1 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table. Note: This update includes corrections to the original fix for later Debian releases to avoid the issues identified in CVE-2012-5370.