Lucene search

RubySecRUBY:RACK-2011-5036-78121

HistoryDec 27, 2011 - 8:00 p.m.

CVE-2011-5036 rubygem-rack: hash table collisions DoS (oCERT-2011-003)

2011-12-2720:00:00

RubySec

nvd.nist.gov

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

EPSS

0.008

Percentile

81.8%

JSON

Rack before 1.1.3, 1.2.x before 1.2.5, and 1.3.x before 1.3.6 computes
hash values for form parameters without restricting the ability to trigger hash
collisions predictably, which allows remote attackers to cause a denial of service
(CPU consumption) by sending many crafted parameters.

Affected configurations

Vulners

Node

rubyrackRange1.1.0–1.1.3

rubyrackRange1.2.0–1.2.5

rubyrackRange1.3.0–1.3.6

rubyrackRange≤1.4.0

VendorProductVersionCPE
rubyrack*cpe:2.3:a:ruby:rack:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ruby	rack	*	cpe:2.3:a:ruby:rack::::::::

References

nvd.nist.gov/vuln/detail/CVE-2011-5036

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

EPSS

0.008

Percentile

81.8%

JSON

Related for RUBY:RACK-2011-5036-78121