Lucene search
Gentoo FoundationGLSA-201207-06HistoryJul 09, 2012 - 12:00 a.m.
JRuby: Denial of service
2012-07-0900:00:00
Gentoo Foundation
security.gentoo.org
12
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
0.01 Low
EPSS
Percentile
83.2%
Background
JRuby is a Java-based Ruby interpreter implementation.
Description
JRuby does not properly randomize hash functions to protect against hash collision attacks.
Impact
A remote attacker could send a specially crafted input, possibly resulting in a Denial of Service condition.
Workaround
There is no known workaround at this time.
Resolution
All JRuby users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-java/jruby-1.6.5.1"
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| Gentoo | any | all | dev-java/jruby | < 1.6.5.1 | UNKNOWN |
Related
cve
cve
CVE-2011-4838
2011-12-30 01:55:00
CVE-2012-5370
2012-11-28 13:03:00
debiancve
debiancve
CVE-2011-4838
2011-12-30 01:55:00
CVE-2012-5370
2012-11-28 13:03:00
prion
prion
Code injection
2011-12-30 01:55:00
Design/Logic Flaw
2012-11-28 13:03:00
nessus
nessus
GLSA-201207-06 : JRuby: Denial of Service
2012-07-10 00:00:00
Debian DLA-209-1 : jruby security update
2015-04-30 00:00:00
checkpoint_security
checkpoint_security
openvas
openvas
Gentoo Security Advisory GLSA 201207-06 (jruby)
2012-08-10 00:00:00
Gentoo Security Advisory GLSA 201207-06 (jruby)
2012-08-10 00:00:00
Debian: Security Advisory (DLA-209-1)
2023-03-08 00:00:00
ubuntucve
ubuntucve
CVE-2011-4838
2011-12-30 00:00:00
CVE-2012-5370
2012-11-28 00:00:00
rubygems
rubygems
CVE-2011-4838 jruby: hash table collisions DoS (oCERT-2011-003)
2011-12-26 20:00:00
CVE-2012-5370 jruby: Murmur hash function collisions (oCERT-2012-001)
2012-11-22 20:00:00
osv
osv
jruby - security update
2015-04-29 00:00:00
JRuby denial of service via Hash Collision
2022-05-17 04:17:07
github
github
JRuby denial of service via Hash Collision
2022-05-17 04:17:07
debian
debian
[SECURITY] [DLA 209-1] jruby security update
2015-04-29 10:47:27
ibm
ibm
freebsd
freebsd
Multiple implementations -- DoS via hash algorithm collision
2011-12-28 00:00:00
cert
cert
Hash table implementations vulnerable to algorithmic complexity attacks
2011-12-28 00:00:00
seebug
seebug
securityvulns
securityvulns
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
0.01 Low
EPSS
Percentile
83.2%
Related for GLSA-201207-06