Red Hat Bugzilla – Bug 853107
CVE-2012-3543 mono: Hash collision issue
Last modified: 2015-07-31 02:53:17 EDT
Common Vulnerabilities and Exposures assigned an identifier CVE-2011-3414 to the following vulnerability:
The CaseInsensitiveHashProvider.getHashCode function in the HashTable implementation in the ASP.NET subsystem in Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5 SP1, 3.5.1, and 4.0 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters, aka "Collisions in HashTable May Cause DoS Vulnerability."
It has been reported:
that the very same issue is present also in Mono .NET implementation too.
The CVE identifier of CVE-2012-3543 has been assigned:
to this flaw in Mono .NET implementation.
Mono upstream patches:
This issue affects the versions of the mono package, as shipped with Fedora release of 16 and 17. Please schedule an update.
This issue affects the versions of the mono package, as shipped with Fedora EPEL 5 and Fedora EPEL 6. Please schedule an update.
Created mono tracking bugs for this issue
Affects: fedora-all [bug 853110]
Affects: epel-all [bug 853111]
(In reply to comment #1)
> This issue affects the versions of the mono package, as shipped with Fedora
> EPEL 5 and Fedora EPEL 6. Please schedule an update.
I'm not going to fix this issue till upstream releases a proper patch for the 2.4.3 branch
(In reply to leigh scott from comment #3)
> (In reply to comment #1)
> > This issue affects the versions of the mono package, as shipped with Fedora
> > EPEL 5 and Fedora EPEL 6. Please schedule an update.
> I'm not going to fix this issue till upstream releases a proper patch for
> the 2.4.3 branch
This will never happen. Mono 2.x is EOL upstream, so this upstream fix seems to only in the 3.x branch but none of the release notes mention it.