CVE-2012-0840 tables/apr_hash.c in the Apache Portable Runtime (APR) library through 1.4.5 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent...
MediumCVSS 5.0
EPSS 42.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
tables/apr_hash.c in the Apache Portable Runtime (APR) library through 1.4.5 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/apr(Debian:12) | < 1.4.6-1 | 1.4.6-1 |
| debian/apr(Debian:13) | < 1.4.6-1 | 1.4.6-1 |
| debian/apr(Debian:14) | < 1.4.6-1 | 1.4.6-1 |
| apache portable runtime | <= 1.4.5 | No fix listed |
| apache portable runtime | = 0.9.1 | No fix listed |
| apache portable runtime | = 0.9.2 | No fix listed |
| apache portable runtime | = 0.9.2-dev | No fix listed |
| apache portable runtime | = 0.9.3 | No fix listed |
| apache portable runtime | = 0.9.3-dev | No fix listed |
| apache portable runtime | = 0.9.4 | No fix listed |
| apache portable runtime | = 0.9.5 | No fix listed |
| apache portable runtime | = 0.9.6 | No fix listed |
| apache portable runtime | = 0.9.7 | No fix listed |
| apache portable runtime | = 0.9.7-dev | No fix listed |
| apache portable runtime | = 0.9.8 | No fix listed |
| apache portable runtime | = 0.9.9 | No fix listed |
| apache portable runtime | = 0.9.16-dev | No fix listed |
| apache portable runtime | = 1.3.0 | No fix listed |
| apache portable runtime | = 1.3.1 | No fix listed |
| apache portable runtime | = 1.3.2 | No fix listed |
| apache portable runtime | = 1.3.3 | No fix listed |
| apache portable runtime | = 1.3.4 | No fix listed |
| apache portable runtime | = 1.3.4-dev | No fix listed |
| apache portable runtime | = 1.3.5 | No fix listed |
| apache portable runtime | = 1.3.6 | No fix listed |
Show 13 more
| Product | Affected versions | Fixed in |
|---|---|---|
| apache portable runtime | = 1.3.6-dev | No fix listed |
| apache portable runtime | = 1.3.7 | No fix listed |
| apache portable runtime | = 1.3.8 | No fix listed |
| apache portable runtime | = 1.3.9 | No fix listed |
| apache portable runtime | = 1.3.10 | No fix listed |
| apache portable runtime | = 1.3.11 | No fix listed |
| apache portable runtime | = 1.3.12 | No fix listed |
| apache portable runtime | = 1.3.13 | No fix listed |
| apache portable runtime | = 1.4.0 | No fix listed |
| apache portable runtime | = 1.4.1 | No fix listed |
| apache portable runtime | = 1.4.2 | No fix listed |
| apache portable runtime | = 1.4.3 | No fix listed |
| apache portable runtime | = 1.4.4 | No fix listed |
References
- Debian Security Tracker CVE-2012-0840 vendor-advisory
- bugs.debian.org issue-tracking
- [apr-commits] 20120115 svn commit: r1231605 - /apr/apr/trunk/tables/apr_hash.c mailing-list
- [oss-security] 20120208 CVE request: apr - Hash DoS vulnerability mailing-list
- [oss-security] 20120208 Re: CVE request: apr - Hash DoS vulnerability mailing-list
- 47862 third-party-advisory vendor-advisory
- svn.apache.org patch
- [dev] 20120105 Hash collision vectors in APR? mailing-list
- [dev] 20120113 Re: Hash collision vectors in APR? mailing-list
- [dev] 20120114 Re: Hash collision vectors in APR? mailing-list
- MDVSA-2012:019 vendor-advisory
- apacheapr-hash-dos(73096) vdb-entry