Vulnerability Description
Apache Geronimo 2.2.1 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters. NOTE: this might overlap CVE-2011-4461.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Geronimo | <= 2.2.1 |
Related Weaknesses (CWE)
References
- http://archives.neohapsis.com/archives/bugtraq/2011-12/0181.html
- http://secunia.com/advisories/47412
- http://www.kb.cert.org/vuls/id/903934US Government Resource
- http://www.nruns.com/_downloads/advisory28122011.pdf
- http://www.ocert.org/advisories/ocert-2011-003.html
- https://github.com/FireFart/HashCollision-DOS-POC/blob/master/HashtablePOC.py
- https://lists.apache.org/thread.html/r20957aa5962a48328f199e2373f408aeeae601a45d
- https://lists.apache.org/thread.html/r360b70489bad65286b49ceb5303a849d2a7ec7d129
- https://lists.apache.org/thread.html/r3c541f019b74902e8e61d73e40ecc2837dfce1b744
- https://lists.apache.org/thread.html/r4fe6b5ff1d48e23337304fd5ac983d89328aecbd1f
- https://lists.apache.org/thread.html/r653f633aa7b6ccbb8c338dbfcea7a00e4ae9d6f3e0
- https://lists.apache.org/thread.html/r67747af92035942c9c413bd8394acbb8a1ace5833c
- https://lists.apache.org/thread.html/r8dc1a0ae0e0cf9d2494b8cbd66562f99331c4cf635
- https://lists.apache.org/thread.html/ra10015f6f3c3c88b7d813383554e87c06347fe1634
- https://lists.apache.org/thread.html/ra1fe29f6399b68980f914d8613dee7f67d62a1a977
FAQ
What is CVE-2011-5034?
CVE-2011-5034 is a vulnerability with a CVSS score of 7.8 (HIGH). Apache Geronimo 2.2.1 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of se...
How severe is CVE-2011-5034?
CVE-2011-5034 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2011-5034?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Geronimo.