QwikSec

Security Database

CVE

CWE

Training

CVE-2011-4815

Published: Dec 30, 2011

Modified: Aug 7, 2024

PUBLISHED

Description

Ruby (aka CRuby) before 1.8.7-p357 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

third-party-advisory

x_refsource_SECUNIA

vdb-entry

x_refsource_SECTRACK

http://www.nruns.com/_downloads/advisory28122011.pdf

x_refsource_MISC

third-party-advisory

x_refsource_SECUNIA

vendor-advisory

x_refsource_REDHAT

third-party-advisory

x_refsource_JVN

ruby-hash-dos(72020)

vdb-entry

x_refsource_XF

third-party-advisory

x_refsource_CERT-VN

[ruby-talk] 20111228 [ANN] ruby 1.8.7 patchlevel 357 released

mailing-list

x_refsource_MLIST

http://www.ruby-lang.org/en/news/2011/12/28/denial-of-service-attack-was-found-for-rubys-hash-algorithm/

x_refsource_CONFIRM

20111228 n.runs-SA-2011.004 - web programming languages and platforms - DoS through hash table

mailing-list

x_refsource_BUGTRAQ

vendor-advisory

x_refsource_REDHAT

http://support.apple.com/kb/HT5281

x_refsource_CONFIRM

APPLE-SA-2012-05-09-1

vendor-advisory

x_refsource_APPLE

JVNDB-2012-000066

third-party-advisory

x_refsource_JVNDB

http://www.ocert.org/advisories/ocert-2011-003.html

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.