CVE-2012-0839

2012-02-0800:00:00

ubuntu.com

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.006 Low

EPSS

Percentile

79.4%

JSON

OCaml 3.12.1 and earlier computes hash values without restricting the
ability to trigger hash collisions predictably, which allows
context-dependent attackers to cause a denial of service (CPU consumption)
via crafted input to an application that maintains a hash table.

Bugs

Notes

Author	Note
mdeslaur	New randomization turned off by default and must be specifically turned on by application. See upstream bug report. Downgrading severity to low, since upstream won’t change default behaviour.