Common Vulnerabilities and Exposures assigned an identifier CVE-2011-3414 to the following vulnerability: The CaseInsensitiveHashProvider.getHashCode function in the HashTable implementation in the ASP.NET subsystem in Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5 SP1, 3.5.1, and 4.0 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters, aka "Collisions in HashTable May Cause DoS Vulnerability." It has been reported: [1] http://www.openwall.com/lists/oss-security/2012/08/28/12 that the very same issue is present also in Mono .NET implementation too. The CVE identifier of CVE-2012-3543 has been assigned: [2] http://www.openwall.com/lists/oss-security/2012/08/28/14 to this flaw in Mono .NET implementation. Mono upstream patches: [3] https://github.com/mono/mono/commit/2ab1a051058fee5ea3aec2e071fba7000b693488 [4] https://github.com/mono/mono/commit/c3e088bf2fc22d66d0f17b74676de366f661c3eb References: [5] https://bugzilla.novell.com/show_bug.cgi?id=739119
This issue affects the versions of the mono package, as shipped with Fedora release of 16 and 17. Please schedule an update. -- This issue affects the versions of the mono package, as shipped with Fedora EPEL 5 and Fedora EPEL 6. Please schedule an update.
Created mono tracking bugs for this issue Affects: fedora-all [bug 853110] Affects: epel-all [bug 853111]
(In reply to comment #1) > This issue affects the versions of the mono package, as shipped with Fedora > EPEL 5 and Fedora EPEL 6. Please schedule an update. I'm not going to fix this issue till upstream releases a proper patch for the 2.4.3 branch https://github.com/mono/mono/tree/mono-2-4-3
(In reply to leigh scott from comment #3) > (In reply to comment #1) > > > This issue affects the versions of the mono package, as shipped with Fedora > > EPEL 5 and Fedora EPEL 6. Please schedule an update. > > > I'm not going to fix this issue till upstream releases a proper patch for > the 2.4.3 branch > > https://github.com/mono/mono/tree/mono-2-4-3 This will never happen. Mono 2.x is EOL upstream, so this upstream fix seems to only in the 3.x branch but none of the release notes mention it.
This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.