Miggo Logo

CVE-2012-5370: JRuby denial of service via Hash Collision

5

CVSS Score

Basic Information

EPSS Score
0.68616%
Published
5/17/2022
Updated
8/29/2023
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
AV:N/AC:L/Au:N/C:N/I:N/A:P
Package NameEcosystemVulnerable VersionsFirst Patched Version
org.jruby:jruby-parentmaven< 1.7.11.7.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability CVE-2012-5370 stems from JRuby's use of MurmurHash2, which is susceptible to collision attacks. The commit diff shows that the fix replaced the hash implementation in RubyString.java's strHashCode() and unseededStrHashCode() methods with PerlHash. Prior to the patch, these methods used a vulnerable algorithm (implied to be MurmurHash2 based on CVE details), leading to predictable collisions. The confidence is high because the commit directly modifies these functions to address the issue, and the CVE explicitly links hash collisions to the MurmurHash2 algorithm.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

JRu*y *omput*s **s* v*lu*s wit*out prop*rly r*stri*tin* t** **ility to tri***r **s* *ollisions pr**i*t**ly, w*i** *llows *ont*xt-**p*n**nt *tt**k*rs to **us* * **ni*l o* s*rvi** (*PU *onsumption) vi* *r**t** input to *n *ppli**tion t**t m*int*ins * *

Reasoning

T** vuln*r**ility *V*-****-**** st*ms *rom JRu*y's us* o* `Murmur**s**`, w*i** is sus**pti*l* to *ollision *tt**ks. T** *ommit *i** s*ows t**t t** *ix r*pl**** t** **s* impl*m*nt*tion in `Ru*yStrin*.j*v*`'s `str**s**o**()` *n* `uns*****Str**s**o**()`