CVE-2012-5370

Publication date 28 November 2012

Last updated 24 July 2024

Ubuntu priority

Medium

Why this priority?

JRuby computes hash values without properly restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table, as demonstrated by a universal multicollision attack against the MurmurHash2 algorithm, a different vulnerability than CVE-2011-4838.

Status

Package Ubuntu Release Status
jruby 17.04 zesty
Not affected
16.10 yakkety
Fixed 1.7.19-1
16.04 LTS xenial
Fixed 1.7.19-1
15.10 wily Ignored end of life
15.04 vivid Ignored end of life
14.10 utopic Ignored end of life
14.04 LTS trusty
Fixed 1.5.6-5
13.10 saucy Ignored end of life
13.04 raring Ignored end of life
12.10 quantal Ignored end of life
12.04 LTS precise Ignored end of life
11.10 oneiric Ignored end of life
10.04 LTS lucid Ignored end of life
8.04 LTS hardy Not in release