Denial of Service Vulnerability in JRuby: Hash Collision Attack
Summary
DEBIAN-CVE-2012-5370: JRuby computes hash values without properly restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an... Affects jruby versions < 1.5.6-5. Fixed in 1.5.6-5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
JRuby is an implementation of the Ruby programming language on the Java Virtual Machine (JVM). It allows Ruby applications to run on the JVM, enabling the use of Java libraries and providing performance benefits. However, JRuby has a vulnerability that allows attackers to exploit hash collisions, potentially leading to denial of service (DoS) conditions in applications that utilize hash tables.
Vulnerability Detail
The vulnerability identified as CVE-2012-5370 arises from JRuby's method of computing hash values without adequately restricting the ability to trigger hash collisions. This flaw allows context-dependent attackers to craft specific input that can cause excessive CPU consumption, leading to denial of service. The vulnerability is particularly concerning as it can be exploited through a universal multicollision attack against the MurmurHash2 algorithm, which is used in JRuby's hash table implementation.
How To Fix
Minimum fixed version
1.5.6-5
This is the first release that contains the fix.
sudo apt-get install --only-upgrade jrubyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can implement input validation to limit the types of data that can be processed by the application, thereby reducing the risk of triggering hash collisions. Additionally, consider using alternative hash algorithms that are less susceptible to collision attacks.
Conclusion
The vulnerability CVE-2012-5370 in JRuby poses a significant risk by allowing denial of service attacks through hash collisions. It is crucial for developers to update to the patched version 1.5.6-5 to safeguard their applications. In the meantime, implementing workarounds can help mitigate the risk until an update can be applied.
See every vulnerability recorded for jruby →
FAQ
CVE-2012-5370 is a vulnerability in JRuby that allows attackers to exploit hash collisions, potentially leading to denial of service.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which analyzes your manifest file for vulnerabilities.
The primary consequence is denial of service, where an attacker can cause the application to consume excessive CPU resources, leading to performance degradation or crashes.
Yes, the patched version of JRuby is 1.5.6-5. Updating to this version will mitigate the vulnerability.
If immediate updates are not possible, implement input validation and consider using alternative hashing algorithms to reduce the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for jruby.
