REDHAT-BUG-770820

First published: Thu Dec 29 2011(Updated: )

Julian Wälde and Alexander Klink reported a flaw in the hash function used in the implementation of the JRuby arrays implemented using the hash table. A specially-crafted set of keys could trigger hash function collisions, which degrade hash table performance by changing hash table operations complexity from an expected/average O(1) to the worst case O(n). Reporters were able to find colliding strings efficiently using equivalent substrings or meet in the middle techniques. As various web application frameworks for Ruby automatically pre-fill certain arrays with data from the HTTP request (such as GET or POST parameters) for Ruby web applications, a remote attacker could use this flaw to make the Ruby interpreter use an excessive amount of CPU time by sending a POST request with a large number parameters which hash to the same value. This problem is similar to the issue that was previously reported for and fixed in e.g. perl: <a href="http://www.cs.rice.edu/~scrosby/hash/CrosbyWallach_UsenixSec2003.pdf">http://www.cs.rice.edu/~scrosby/hash/CrosbyWallach_UsenixSec2003.pdf</a> Note: This issue have been fixed in version 1.6.5.1 of JRuby <a href="http://www.jruby.org/2011/12/27/jruby-1-6-5-1.html">http://www.jruby.org/2011/12/27/jruby-1-6-5-1.html</a>

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• collector/redhat-bugzilla
• alias/CVE-2011-4838
• agent/references
• agent/type
• agent/first-publish-date
• agent/last-modified-date
• agent/severity
• agent/description
• agent/event
• agent/softwarecombine
• agent/tags
• agent/guess-ai
• agent/software-canonical-lookup
• agent/software-canonical-lookup-request
• vendor/jruby
• canonical/rubygems