SUSE CVE-2022-3433

The aeson library is not safe to use to consume untrusted JSON input. A remote user could abuse this flaw to produce a hash collision in the underlying unordered-containers library by sending specially crafted JSON data, resulting in a denial of service...

SUSE CVE-2022-21653

Jawn is an open source JSON parser. Extenders of the org.typelevel.jawn.SimpleFacade and org.typelevel.jawn.MutableFacade who don't override objectContext are vulnerable to a hash collision attack which may result in a denial of service. Most applications do not implement these traits directly, b...

GHSA-5RHG-XHGR-5HFJ go-saml's XML Digital Signatures use SHA-1

XML Digital Signatures generated and validated using this package use SHA-1, which may allow an attacker to craft inputs which cause hash collisions depending on their control over the input...

go-saml's XML Digital Signatures use SHA-1

XML Digital Signatures generated and validated using this package use SHA-1, which may allow an attacker to craft inputs which cause hash collisions depending on their control over the input...

CVE-2020-36563

XML Digital Signatures generated and validated using this package use SHA-1, which may allow an attacker to craft inputs which cause hash collisions depending on their control over the input...

Input validation

XML Digital Signatures generated and validated using this package use SHA-1, which may allow an attacker to craft inputs which cause hash collisions depending on their control over the input...

Use of Weak Hash

XML Digital Signatures generated and validated using this package use SHA-1, which may allow an attacker to craft inputs which cause hash collisions depending on their control over the input...

CVE-2020-36563 Weak hash (SHA-1) in github.com/RobotsAndPencils/go-saml

XML Digital Signatures generated and validated using this package use SHA-1, which may allow an attacker to craft inputs which cause hash collisions depending on their control over the input...

CVE-2020-36563

The CVE concerns the go-saml library by Robots and Pencils, where XML Digital Signatures are generated/validated using SHA-1. The root cause is the use of SHA-1 in signatures, enabling potential hash collisions when an attacker can influence the input. Reported impact in the CVE notes a partial i...

CVE-2020-36563 Weak hash (SHA-1) in github.com/RobotsAndPencils/go-saml

XML Digital Signatures generated and validated using this package use SHA-1, which may allow an attacker to craft inputs which cause hash collisions depending on their control over the input...

CVE-2022-3433

The aeson library is not safe to use to consume untrusted JSON input. A remote user could abuse this flaw to produce a hash collision in the underlying unordered-containers library by sending specially crafted JSON data, resulting in a denial of service...

DEBIAN-CVE-2022-3433

The aeson library is not safe to use to consume untrusted JSON input. A remote user could abuse this flaw to produce a hash collision in the underlying unordered-containers library by sending specially crafted JSON data, resulting in a denial of service...

UBUNTU-CVE-2022-3433

The aeson library is not safe to use to consume untrusted JSON input. A remote user could abuse this flaw to produce a hash collision in the underlying unordered-containers library by sending specially crafted JSON data, resulting in a denial of service...

PT-2022-7465

Name of the Vulnerable Software and Affected Versions aeson affected versions not specified Description The aeson library is not safe for consuming untrusted JSON input. A remote user could exploit this issue to produce a hash collision in the underlying unordered-containers library by sending...

aeson 加密问题漏洞

aeson is a fast Haskell library open-sourced by Haskell for processing JSON data. A security vulnerability exists in aeson, which stems from the fact that it allows the use of untrusted JSON input to cause a denial of service by allowing a remote user to send specially crafted JSON data to create...

CLSA-2022-1654174467 Fix CVE(s): CVE-2021-33582

SECURITY UPDATE: String hashing algorithm collisions - debian/patches/CVE-2021-33582-pre.patch: gracefully handle lookup on zero-sized tables - debian/patches/CVE-2021-33582-1.patch: replace ad-hoc algorithm with seeded djb2 in strhash - debian/patches/CVE-2021-33582-2.patch: use a seed when...

CLSA-2022-1654107183 Fixed CVE-2021-33582 in cyrus-imapd

CVE-2021-33582: Fix a bad string hashing algorithm which could lead to collisions and cause a CPU denial of service...

Rack Gem Subject to Denial of Service via Hash Collisions

Rack before 1.1.3, 1.2.x before 1.2.5, and 1.3.x before 1.3.6 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service CPU consumption by sending many crafted parameters...

GHSA-V6J3-7JRW-HQ2P Rack Gem Subject to Denial of Service via Hash Collisions

Rack before 1.1.3, 1.2.x before 1.2.5, and 1.3.x before 1.3.6 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service CPU consumption by sending many crafted parameters...

Improper Input Validation in Apache Tomcat

Apache Tomcat before 5.5.35, 6.x before 6.0.35, and 7.x before 7.0.23 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service CPU consumption by sending many crafted parameters...