oss-sec mailing list archives
Re: CVE request: java hashdos vulnerability
From: Kurt Seifried <kseifried () redhat com>
Date: Sat, 16 Jun 2012 19:35:37 -0600
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 06/15/2012 03:13 PM, Hanno Böck wrote:
Hi, Seems java is fixing HashDos finally: http://mail.openjdk.java.net/pipermail/core-libs-dev/2012-May/010238.html They don't mention hashdos, but the interesting part is here: "The enhanced hashing implementation uses the murmur3 hashing algorithm[1] along with random hash seeds and index masks" random hash seeds is what prevents hashdos. Further info here: http://armoredbarista.blogspot.de/2012/02/investigating-hashdos-issue.html Please assign CVE. cu,
Please use CVE-2012-2739 for this issue. - -- Kurt Seifried Red Hat Security Response Team (SRT) PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iQIcBAEBAgAGBQJP3TRpAAoJEBYNRVNeJnmTxn0QAKxwvxvhuT1kRmfgIQBHCIIv TbPsz7Ve53LbyT2tEXwWzEO406sUbtUK1rC6ziWkZraihCghkX7pYwG3CkFKRDcj RCos6/THW6aJ1X3BIeOJnFYLPdX+ayEKa9lkVOBB8DChnNT6gDfCnWHwcr0K6nhs hiwoofIjlbwA9HZnDGFt4INUv19Eo3AQ/q6j99N+o+nraRye/DUoYU+VZe4rLICQ sCHdkKdGWp5889lItap19hWLTSWNjzkXIyZIcVAc7qw7NAApLVRrA7kCVOQHc4+4 YQTHy/6jaPdjFjwRNyKFczIq5i3BO9tcAr8SQrrjujImMCCDGwgk2k8Pti6KSAJE 9w1lL2uUHCKdRvheUZi2NppbMDnhlqtnugFDZdePHUp5JeAk2Er6fNIjH6r8LKym 3AuWhCRlxQ1aH0qcck8K/7CgcfzSLNixgDoU0OVmlmZ8qn/wp7bNddQKOyQ0A72q VBnnD9qRQ8hx1ZL3keybUMP63yymOwlVHzb1cKJwbgiT21+Pr7mxekrPkmixPiah Ac6LsMOiyU9N04aAed18N1CHcm5hfU+fKZGXn6J4HLzjTN4VYcitfE/qWYaJLuRm 6mvlpBEVMpgbteT3Rv2aJ7Bhhd1EQ/sbOMUbU7UH5/nX2ntt6PZ3ph4Gcx99ML68 VvgDhCr3p/bOQh8uFZZu =3E+5 -----END PGP SIGNATURE-----
Current thread:
- CVE request: java hashdos vulnerability Hanno Böck (Jun 15)
- Re: CVE request: java hashdos vulnerability Kurt Seifried (Jun 16)