CVE-2011-4838: Medium severity ruby vulnerability
JRuby before 1.6.5.1 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table.
Other sources
Julian Wälde and Alexander Klink reported a flaw in the hash function used in the implementation of the JRuby arrays implemented using the hash table.
A specially-crafted set of keys could trigger hash function collisions, which degrade hash table performance by changing hash table operations complexity from an expected/average O(1) to the worst case O(n). Reporters were able to find colliding strings efficiently using equivalent substrings or meet in the middle techniques.
As various web application frameworks for Ruby automatically pre-fill certain arrays with data from the HTTP request (such as GET or POST parameters) for Ruby web applications, a remote attacker could use this flaw to make the Ruby interpreter use an excessive amount of CPU time by sending a POST request with a large number parameters which hash to the same value.
This problem is similar to the issue that was previously reported for and fixed in e.g. perl: http://www.cs.rice.edu/~scrosby/hash/CrosbyWallachUsenixSec2003.pdf
Note: This issue have been fixed in version 1.6.5.1 of JRuby http://www.jruby.org/2011/12/27/jruby-1-6-5-1.html
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2011-4838?
CVE-2011-4838 has a severity rating that indicates it can lead to denial of service due to hash collision attacks.
How do I fix CVE-2011-4838?
To fix CVE-2011-4838, upgrade JRuby to version 1.6.5.1 or later.
What are the implications of CVE-2011-4838 for my application?
CVE-2011-4838 may allow attackers to consume CPU resources, causing performance issues or downtime for applications using JRuby.
Which versions of JRuby are affected by CVE-2011-4838?
CVE-2011-4838 affects all versions of JRuby prior to 1.6.5.1.
Can I identify if my application is vulnerable to CVE-2011-4838?
You can identify vulnerability to CVE-2011-4838 by checking the JRuby version in use and reviewing application input handling for hash tables.