CVE-2011-4838 JRuby before 1.6.5.1 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption...
MediumCVSS 5.0
EPSS 4.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
JRuby before 1.6.5.1 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/jruby(Debian:12) | < 1.5.6-4 | 1.5.6-4 |
| debian/jruby(Debian:13) | < 1.5.6-4 | 1.5.6-4 |
| debian/jruby(Debian:14) | < 1.5.6-4 | 1.5.6-4 |
| jruby | < 1.6.5.1 | 1.6.5.1 |
References
- Debian Security Tracker CVE-2011-4838 vendor-advisory
- 20111228 n.runs-SA-2011.004 - web programming languages and platforms - DoS through hash table broken-link mailing-list
- jruby.org vendor-advisory
- RHSA-2012:1232 broken-link vendor-advisory
- 47407 third-party-advisory
- 50084 third-party-advisory
- GLSA-201207-06 third-party-advisory vendor-advisory
- VU#903934 third-party-advisory us-government-resource
- www.nruns.com third-party-advisory
- www.ocert.org third-party-advisory
- jruby-hash-dos(72019) third-party-advisory vdb-entry
- bugs.debian.org issue-tracking