Vulnerabilities > CVE-2012-5370 - Cryptographic Issues vulnerability in Jruby

047910
CVSS 0.0 - NONE
Attack vector
UNKNOWN
Attack complexity
UNKNOWN
Privileges required
UNKNOWN
Confidentiality impact
UNKNOWN
Integrity impact
UNKNOWN
Availability impact
UNKNOWN
jruby
CWE-310
nessus
NVD
Published: 2012-11-28
Updated: 2024-11-21

Summary

JRuby computes hash values without properly restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table, as demonstrated by a universal multicollision attack against the MurmurHash2 algorithm, a different vulnerability than CVE-2011-4838.

Vulnerable Configurations

Part Description Count
Application
Jruby
1

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Signature Spoofing by Key Recreation
    An attacker obtains an authoritative or reputable signer's private signature key by exploiting a cryptographic weakness in the signature algorithm or pseudorandom number generation and then uses this key to forge signatures from the original signer to mislead a victim into performing actions that benefit the attacker.

Nessus

NASL familyDebian Local Security Checks
NASL idDEBIAN_DLA-209.NASL
descriptionJRuby before 1.6.5.1 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table. Note: This update includes corrections to the original fix for later Debian releases to avoid the issues identified in CVE-2012-5370. NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen2020-03-17
modified2015-04-30
plugin id83142
published2015-04-30
reporterThis script is Copyright (C) 2015-2020 Tenable Network Security, Inc.
sourcehttps://www.tenable.com/plugins/nessus/83142
titleDebian DLA-209-1 : jruby security update

Redhat

advisories
rhsa
idRHSA-2013:0533

References