CVE-2011-4815 Ruby (aka CRuby) before 1.8.7-p357 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (C...
HighCVSS 7.8
EPSS 4.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Ruby (aka CRuby) before 1.8.7-p357 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ruby-lang ruby | <= 1.8.7-p352 | No fix listed |
| ruby-lang ruby | = 1.8.7-p299 | No fix listed |
| ruby-lang ruby | = 1.8.7-p302 | No fix listed |
| ruby-lang ruby | = 1.8.7-p330 | No fix listed |
| ruby-lang ruby | = 1.8.7-p334 | No fix listed |
References
- 20111228 n.runs-SA-2011.004 - web programming languages and platforms - DoS through hash table mailing-list
- [ruby-talk] 20111228 [ANN] ruby 1.8.7 patchlevel 357 released mailing-list
- JVN#90615481 third-party-advisory
- JVNDB-2012-000066 third-party-advisory
- APPLE-SA-2012-05-09-1 vendor-advisory
- RHSA-2012:0069 vendor-advisory
- RHSA-2012:0070 vendor-advisory
- 47405 third-party-advisory
- 47822 third-party-advisory
- support.apple.com
- VU#903934 third-party-advisory us-government-resource
- www.nruns.com
- www.ocert.org
- www.ruby-lang.org
- 1026474 vdb-entry
- ruby-hash-dos(72020) vdb-entry