Lucene search

K
freebsdFreeBSD5E647CA3-2AEA-11E2-B745-001FD0AF1A4C
HistoryNov 10, 2012 - 12:00 a.m.

ruby -- Hash-flooding DoS vulnerability for ruby 1.9

2012-11-1000:00:00
vuxml.freebsd.org
11

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.006 Low

EPSS

Percentile

77.6%

The official ruby site reports:

Carefully crafted sequence of strings can cause a denial of service
attack on the service that parses the sequence to create a Hash
object by using the strings as keys. For instance, this
vulnerability affects web application that parses the JSON data
sent from untrusted entity.
This vulnerability is similar to CVS-2011-4815 for ruby 1.8.7. ruby
1.9 versions were using modified MurmurHash function but it’s
reported that there is a way to create sequence of strings that
collide their hash values each other. This fix changes the Hash
function of String object from the MurmurHash to SipHash 2-4.

OSVersionArchitecturePackageVersionFilename
FreeBSDanynoarchruby= 1.9UNKNOWN
FreeBSDanynoarchruby< 1.9.3.327UNKNOWN

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.006 Low

EPSS

Percentile

77.6%