CVE-2011-4815

Ruby (aka CRuby) before 1.8.7-p357 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table.

Affected products

Centos, Red Hat, Ruby, Suse

Ruby-lang Ruby

≤ 1.8.7-p352, 1.8.7-p299, 1.8.7-p302, 1.8.7-p330, 1.8.7-p334

CVSS 2.0

7.8 HIGH

EPSS

4.2% (90th percentile)

Weakness

CWE-20

NVD status

Modified

Published

2011-12-30