CVE-2012-5371

2012-11-2800:00:00

ubuntu.com

CVSS2

7.8

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

EPSS

0.02

Percentile

88.9%

JSON

Ruby (aka CRuby) 1.9 before 1.9.3-p327 and 2.0 before r37575 computes hash
values without properly restricting the ability to trigger hash collisions
predictably, which allows context-dependent attackers to cause a denial of
service (CPU consumption) via crafted input to an application that
maintains a hash table, as demonstrated by a universal multicollision
attack against a variant of the MurmurHash2 algorithm, a different
vulnerability than CVE-2011-4815.

Bugs

<http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=693024>

OSVersionArchitecturePackageVersionFilename
ubuntu12.04noarchruby1.9.1< 1.9.3.0-1ubuntu2.5UNKNOWN
ubuntu12.10noarchruby1.9.1< 1.9.3.194-1ubuntu1.3UNKNOWN
ubuntu13.04noarchruby1.9.1< 1.9.3.194-7ubuntu1UNKNOWN
ubuntu13.10noarchruby1.9.1< 1.9.3.194-7ubuntu1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	12.04	noarch	ruby1.9.1	< 1.9.3.0-1ubuntu2.5	UNKNOWN
ubuntu	12.10	noarch	ruby1.9.1	< 1.9.3.194-1ubuntu1.3	UNKNOWN
ubuntu	13.04	noarch	ruby1.9.1	< 1.9.3.194-7ubuntu1	UNKNOWN
ubuntu	13.10	noarch	ruby1.9.1	< 1.9.3.194-7ubuntu1	UNKNOWN