{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2011-12-28T00:00:00", "descriptions": [{"lang": "en", "value": "Rack before 1.1.3, 1.2.x before 1.2.5, and 1.3.x before 1.3.6 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2012-11-06T10:00:00", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "http://www.nruns.com/_downloads/advisory28122011.pdf"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://gist.github.com/52bbc6b9cc19ce330829"}, {"name": "VU#903934", "tags": ["third-party-advisory", "x_refsource_CERT-VN"], "url": "http://www.kb.cert.org/vuls/id/903934"}, {"name": "20111228 n.runs-SA-2011.004 - web programming languages and platforms - DoS through hash table", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://archives.neohapsis.com/archives/bugtraq/2011-12/0181.html"}, {"name": "DSA-2783", "tags": ["vendor-advisory", "x_refsource_DEBIAN"], "url": "http://www.debian.org/security/2013/dsa-2783"}, {"tags": ["x_refsource_MISC"], "url": "http://www.ocert.org/advisories/ocert-2011-003.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2011-5036", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Rack before 1.1.3, 1.2.x before 1.2.5, and 1.3.x before 1.3.6 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "http://www.nruns.com/_downloads/advisory28122011.pdf", "refsource": "MISC", "url": "http://www.nruns.com/_downloads/advisory28122011.pdf"}, {"name": "https://gist.github.com/52bbc6b9cc19ce330829", "refsource": "CONFIRM", "url": "https://gist.github.com/52bbc6b9cc19ce330829"}, {"name": "VU#903934", "refsource": "CERT-VN", "url": "http://www.kb.cert.org/vuls/id/903934"}, {"name": "20111228 n.runs-SA-2011.004 - web programming languages and platforms - DoS through hash table", "refsource": "BUGTRAQ", "url": "http://archives.neohapsis.com/archives/bugtraq/2011-12/0181.html"}, {"name": "DSA-2783", "refsource": "DEBIAN", "url": "http://www.debian.org/security/2013/dsa-2783"}, {"name": "http://www.ocert.org/advisories/ocert-2011-003.html", "refsource": "MISC", "url": "http://www.ocert.org/advisories/ocert-2011-003.html"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T00:23:39.882Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://www.nruns.com/_downloads/advisory28122011.pdf"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://gist.github.com/52bbc6b9cc19ce330829"}, {"name": "VU#903934", "tags": ["third-party-advisory", "x_refsource_CERT-VN", "x_transferred"], "url": "http://www.kb.cert.org/vuls/id/903934"}, {"name": "20111228 n.runs-SA-2011.004 - web programming languages and platforms - DoS through hash table", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://archives.neohapsis.com/archives/bugtraq/2011-12/0181.html"}, {"name": "DSA-2783", "tags": ["vendor-advisory", "x_refsource_DEBIAN", "x_transferred"], "url": "http://www.debian.org/security/2013/dsa-2783"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://www.ocert.org/advisories/ocert-2011-003.html"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2011-5036", "datePublished": "2011-12-30T01:00:00", "dateReserved": "2011-12-29T00:00:00", "dateUpdated": "2024-08-07T00:23:39.882Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:rack_project:rack:*:*:*:*:*:*:*:*", "matchCriteriaId": "FC25AA62-8839-47F9-B215-8B08343D4DE2", "versionEndIncluding": "1.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:rack_project:rack:1.2.0:*:*:*:*:*:*:*", "matchCriteriaId": "F4ECE38D-E0CA-4C37-B6A7-385F90FA3BC6", "vulnerable": true}, {"criteria": "cpe:2.3:a:rack_project:rack:1.2.1:*:*:*:*:*:*:*", "matchCriteriaId": "8B347613-F3F6-490C-AAE7-A5054B7D2892", "vulnerable": true}, {"criteria": "cpe:2.3:a:rack_project:rack:1.2.2:*:*:*:*:*:*:*", "matchCriteriaId": "FDA365EF-8CF1-4040-9353-00F0BF0499C0", "vulnerable": true}, {"criteria": "cpe:2.3:a:rack_project:rack:1.2.3:*:*:*:*:*:*:*", "matchCriteriaId": "A27A3B18-AB5A-4F99-AD51-12870745D9FA", "vulnerable": true}, {"criteria": "cpe:2.3:a:rack_project:rack:1.2.4:*:*:*:*:*:*:*", "matchCriteriaId": "C207F012-CEEE-4173-A64D-61A8E8E02533", "vulnerable": true}, {"criteria": "cpe:2.3:a:rack_project:rack:1.3.0:*:*:*:*:*:*:*", "matchCriteriaId": "98CBCA07-8EEC-49D0-8C17-7887ABB63ED6", "vulnerable": true}, {"criteria": "cpe:2.3:a:rack_project:rack:1.3.1:*:*:*:*:*:*:*", "matchCriteriaId": "93B65658-8E1B-4832-822A-1C3770B33BB9", "vulnerable": true}, {"criteria": "cpe:2.3:a:rack_project:rack:1.3.2:*:*:*:*:*:*:*", "matchCriteriaId": "9E9E3412-6D9C-46FC-806E-0E0D310D4DDE", "vulnerable": true}, {"criteria": "cpe:2.3:a:rack_project:rack:1.3.3:*:*:*:*:*:*:*", "matchCriteriaId": "10A95FAF-3314-4F3F-8619-DAED41648AE3", "vulnerable": true}, {"criteria": "cpe:2.3:a:rack_project:rack:1.3.4:*:*:*:*:*:*:*", "matchCriteriaId": "00901558-9028-4BDF-AFE6-502DF2632069", "vulnerable": true}, {"criteria": "cpe:2.3:a:rack_project:rack:1.3.5:*:*:*:*:*:*:*", "matchCriteriaId": "5A8CBC63-DBA8-4A4E-87D7-5B891CDF7091", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Rack before 1.1.3, 1.2.x before 1.2.5, and 1.3.x before 1.3.6 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters."}, {"lang": "es", "value": "Rack anterior a v1.1.3, v1.2.x anterior a v1.2.5, v1.3.6 y v1.3.x calcula los valores hash de los par\u00e1metros de forma, sin restringir la capacidad de desencadenar colisiones hash predecible, lo que permite a atacantes remotos provocar una denegaci\u00f3n de servicio (CPU consumo) mediante el env\u00edo de gran cantidad de par\u00e1metros a mano."}], "id": "CVE-2011-5036", "lastModified": "2024-11-21T01:33:28.483", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2011-12-30T01:55:01.687", "references": [{"source": "cve@mitre.org", "url": "http://archives.neohapsis.com/archives/bugtraq/2011-12/0181.html"}, {"source": "cve@mitre.org", "url": "http://www.debian.org/security/2013/dsa-2783"}, {"source": "cve@mitre.org", "tags": ["US Government Resource"], "url": "http://www.kb.cert.org/vuls/id/903934"}, {"source": "cve@mitre.org", "url": "http://www.nruns.com/_downloads/advisory28122011.pdf"}, {"source": "cve@mitre.org", "url": "http://www.ocert.org/advisories/ocert-2011-003.html"}, {"source": "cve@mitre.org", "tags": ["Exploit"], "url": "https://gist.github.com/52bbc6b9cc19ce330829"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://archives.neohapsis.com/archives/bugtraq/2011-12/0181.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.debian.org/security/2013/dsa-2783"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["US Government Resource"], "url": "http://www.kb.cert.org/vuls/id/903934"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.nruns.com/_downloads/advisory28122011.pdf"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.ocert.org/advisories/ocert-2011-003.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "https://gist.github.com/52bbc6b9cc19ce330829"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-310"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "rubygem-rack: hash table collisions DoS (oCERT-2011-003)", "id": "771149", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=771149"}, "csaw": false, "cvss": {"cvss_base_score": "5.0", "cvss_scoring_vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "status": "draft"}, "cwe": "CWE-407", "details": ["Rack before 1.1.3, 1.2.x before 1.2.5, and 1.3.x before 1.3.6 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters."], "name": "CVE-2011-5036", "package_state": [{"cpe": "cpe:/a:cloudforms_tools:1", "fix_state": "Will not fix", "package_name": "rubygem-rack", "product_name": "Red Hat CloudForms Tools 1"}, {"cpe": "cpe:/a:rhel_sam:1", "fix_state": "Will not fix", "package_name": "rubygem-rack", "product_name": "Red Hat Subscription Asset Manager"}], "public_date": "2011-12-28T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2011-5036\nhttps://nvd.nist.gov/vuln/detail/CVE-2011-5036"], "threat_severity": "Moderate", "upstream_fix": "rubygem-rack 1.1.3, rubygem-rack 1.2.5, rubygem-rack 1.3.6, rubygem-rack 1.4.0"}