Bug 1851431 (CVE-2011-5034) - CVE-2011-5034 apache-geronimo: hash table collisions CPU usage DoS
Summary: CVE-2011-5034 apache-geronimo: hash table collisions CPU usage DoS
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2011-5034
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1851825
Blocks: 1850754
TreeView+ depends on / blocked
 
Reported: 2020-06-26 13:48 UTC by Guilherme de Almeida Suckevicz
Modified: 2021-02-16 19:46 UTC (History)
61 users (show)

Fixed In Version: geronimo 2.2.1
Clone Of:
Environment:
Last Closed: 2020-07-02 07:27:36 UTC
Embargoed:

Attachments (Terms of Use)

Description Guilherme de Almeida Suckevicz 2020-06-26 13:48:34 UTC 
Geronimo 2.2.1 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters. NOTE: this might overlap CVE-2011-4461.

Reference:
http://ocert.org/advisories/ocert-2011-003.html
Comment 1 Summer Long 2020-06-29 06:10:12 UTC 
External References:

https://geronimo.apache.org/22x-security-report.html
Comment 4 Summer Long 2020-06-29 06:28:12 UTC 
Upstream issue: https://issues.apache.org/jira/browse/GERONIMO-6253
Comment 6 Jonathan Christison 2020-06-29 08:13:39 UTC 
This vulnerability is out of security support scope for the following products:
 * Red Hat Jboss Fuse 6
 * Red Hat JBoss A-MQ 6

Please refer to https://access.redhat.com/support/policy/updates/jboss_notes for more details.
Comment 8 Summer Long 2020-06-30 01:38:58 UTC 
Statement:

apache-geronimo is packaged with Red Hat OpenStack Platform 13.0's OpenDaylight (ODL). However because the flaw is moderate, Red Hat will not be releasing a fix for the ODL package at this time.
Comment 11 Product Security DevOps Team 2020-07-02 07:27:36 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2011-5034
Note You need to log in before you can comment on or make changes to this bug.