GitHub Advisoryadvisory · RubyGems, Maven

GHSA-v6j3-7jrw-hq2p Rack Gem Subject to Denial of Service via Hash Collisions

MEDIUM Published 2022-05-17 Modified 2023-08-25 Official page ↗
Aliases
CVE-2011-5036
Ecosystem
RubyGems, Maven
Packages
rack, org.jruby:jruby-parent
Severity
Moderate
Weaknesses
CWE-328, CWE-400
Reviewed
2023-03-27

Affected packages

• RubyGems rack: < 1.1.3 → fixed in 1.1.3 • RubyGems rack: >= 1.2.0, < 1.2.5 → fixed in 1.2.5 • RubyGems rack: >= 1.3.0, < 1.3.6 → fixed in 1.3.6 • Maven org.jruby:jruby-parent: < 1.6.5.1 → fixed in 1.6.5.1

Description

Rack before 1.1.3, 1.2.x before 1.2.5, and 1.3.x before 1.3.6 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.

Related

Alias · CVE (1)

  • CVE-2011-5036 Rack before 1.1.3, 1.2.x before 1.2.5, and 1.3.x before 1.3.6 computes hash values for form parameters without restricting the ability to… vulnerability

Weakness · CWE (2)

  • CWE-328 Use of Weak Hash weakness
  • CWE-400 Uncontrolled Resource Consumption weakness

References