Denial of Service Vulnerability in JRuby: Hash Collision Attack
Summary
CVE-2012-5370: JRuby computes hash values without properly restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an... Affects jruby versions < 1.5.6-5. Fixed in 1.5.6-5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
JRuby is an implementation of the Ruby programming language on the Java Virtual Machine (JVM). It allows Ruby applications to run on the JVM, providing compatibility with Java libraries and performance benefits. However, JRuby is susceptible to a specific vulnerability that allows attackers to exploit hash collisions, leading to potential denial of service (DoS) conditions in applications that utilize hash tables.
Vulnerability Detail
The vulnerability, identified as CVE-2012-5370, arises from JRuby's method of computing hash values without adequate restrictions, enabling attackers to trigger predictable hash collisions. This can lead to excessive CPU consumption, effectively causing a denial of service for applications that rely on hash tables. The attack is characterized by a universal multicollision attack against the MurmurHash2 algorithm, which is distinct from other vulnerabilities such as CVE-2011-4838.
How To Fix
Minimum fixed version
1.5.6-5
This is the first release that contains the fix.
sudo apt-get install --only-upgrade jrubyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately feasible, consider implementing a custom hash function or using a different data structure that is less susceptible to hash collision attacks. Additionally, limiting the size of input data to hash tables can mitigate the impact of potential collisions.
Conclusion
CVE-2012-5370 presents a significant risk to applications using JRuby due to its vulnerability to hash collision attacks. It is crucial for developers to upgrade to the fixed version to ensure the security and stability of their applications. For those unable to upgrade immediately, implementing workarounds can help mitigate the risks.
See every vulnerability recorded for jruby →
FAQ
CVE-2012-5370 is a vulnerability in JRuby that allows attackers to exploit hash collisions, leading to denial of service conditions.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor for open-source vulnerabilities without requiring any installation.
The primary consequence is denial of service due to excessive CPU consumption, which can disrupt the normal functioning of applications that utilize hash tables.
Yes, upgrading to JRuby version 1.5.6-5 or later will resolve the vulnerability.
Consider implementing a custom hash function or using alternative data structures to reduce the risk of hash collisions until you can upgrade.
Related vulnerabilities
Recent vulnerabilities recorded for jruby.
