CVE-2011-4815
HIGH severity · CVSS 7.8 · Improper input validation
7.8CVSS HIGH
Summary
Ruby (aka CRuby) before 1.8.7-p357 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table.
Impact & exploitability
Attack vectorNetwork
Attack complexityLow
Privileges required—
User interaction—
Confidentiality impactNone
Integrity impactNone
Availability impact—
Exploit probability (EPSS)4%
AV:N/AC:L/Au:N/C:N/I:N/A:C
Affected products we track (1)
Recommendation
Apply the vendor fix promptly. Open any affected product above for its exact safe version.
Additional information
- NVD record
- http://archives.neohapsis.com/archives/bugtraq/2011-12/0181.html
- http://blade.nagaokaut.ac.jp/cgi-bin/scat.rb/ruby/ruby-talk/391606
- http://jvn.jp/en/jp/JVN90615481/index.html
- http://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-000066.html
- http://lists.apple.com/archives/security-announce/2012/May/msg00001.html
- http://rhn.redhat.com/errata/RHSA-2012-0069.html
- http://rhn.redhat.com/errata/RHSA-2012-0070.html
- http://secunia.com/advisories/47405