Julian Wälde and Alexander Klink reported a flaw in the hash function used in the implementation of the JRuby arrays implemented using the hash table. A specially-crafted set of keys could trigger hash function collisions, which degrade hash table performance by changing hash table operations complexity from an expected/average O(1) to the worst case O(n). Reporters were able to find colliding strings efficiently using equivalent substrings or meet in the middle techniques. As various web application frameworks for Ruby automatically pre-fill certain arrays with data from the HTTP request (such as GET or POST parameters) for Ruby web applications, a remote attacker could use this flaw to make the Ruby interpreter use an excessive amount of CPU time by sending a POST request with a large number parameters which hash to the same value. This problem is similar to the issue that was previously reported for and fixed in e.g. perl: http://www.cs.rice.edu/~scrosby/hash/CrosbyWallach_UsenixSec2003.pdf Note: This issue have been fixed in version 1.6.5.1 of JRuby http://www.jruby.org/2011/12/27/jruby-1-6-5-1.html
Created jruby tracking bugs for this issue Affects: fedora-16 [bug 770821]
JBoss Enterprise SOA Platform 5.2.0 ships JRuby 1.6.5 as part of the scripting_chain quickstart sample application. JRuby 1.6.5 exposes this flaw, although the sample application itself does not appear to expose the flaw. If the version of JRuby shipped with the scripting_chain sample application was used to build a custom application, then this flaw could be exposed. Bugs have been filed to update the sample application to use JRuby 1.6.5.1: https://issues.jboss.org/browse/JBESB-3725 https://issues.jboss.org/browse/SOA-3680
Acknowledgements: Red Hat would like to thank oCERT for reporting this issue. oCERT acknowledges Julian Wälde and Alexander Klink as the original reporters.
This issue has been addressed in following products: JBoss Enterprise SOA Platform 5.3.0 Via RHSA-2012:1125 https://rhn.redhat.com/errata/RHSA-2012-1125.html
Relevant upstream patch: https://github.com/jruby/jruby/commit/f007944b459e7c5e33b8296433d8b9d704bf02cc