CVE-2011-5035 Oracle Glassfish 2.1.1, 3.0.1, and 3.1.1, as used in Communications Server 2.0, Sun Java System Application Server 8.1 and 8.2, and possibly other products, computes hash values for form parameters wi...
MediumCVSS 5.0
EPSS 68.2%
Framework module
- Published
- Updated
- Exploit status
- Public exploit available
Description
Oracle Glassfish 2.1.1, 3.0.1, and 3.1.1, as used in Communications Server 2.0, Sun Java System Application Server 8.1 and 8.2, and possibly other products, computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters, aka Oracle security ticket S0104869.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| oracle glassfish server | <= 3.1.1 | No fix listed |
| oracle glassfish server | = 2.1.1 | No fix listed |
| oracle glassfish server | = 3.0.1 | No fix listed |
References
- 20111228 n.runs-SA-2011.004 - web programming languages and platforms - DoS through hash table mailing-list
- SUSE-SU-2012:0603 vendor-advisory
- HPSBUX02757 vendor-advisory
- HPSBUX02784 vendor-advisory
- HPSBMU02799 vendor-advisory
- SSRT100867 vendor-advisory
- HPSBST02955 vendor-advisory
- RHSA-2012:0514 vendor-advisory
- RHSA-2013:1455 vendor-advisory
- 48073 third-party-advisory
- 48074 third-party-advisory
- 48589 third-party-advisory
- 48950 third-party-advisory
- 57126 third-party-advisory
- GLSA-201406-32 vendor-advisory
- DSA-2420 vendor-advisory
- VU#903934 third-party-advisory us-government-resource
- MDVSA-2013:150 vendor-advisory
- www.nruns.com
- www.ocert.org
- www.oracle.com
- www.oracle.com
- www.oracle.com
- github.com
- oval:org.mitre.oval:def:16908 signature vdb-entry