VDB
CVE-2012-0840
CVE-2012-0840
PUBLISHED
CVSS 5 MEDIUM
tables/apr_hash.c in the Apache Portable Runtime (APR) library through 1.4.5 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table.
EPSS 42.14% · 98.6th percentile
Risk Scores
CVSS 2.0
5
EPSS Score
42.14%
98.6th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| apache | portable_runtime | 0.9.4, 0, 0.9.1 |
| n/a | n/a | n/a |
Timeline
- Feb 10, 2012 CVE Published
- Feb 4, 2022 EPSS Score
- Mar 29, 2022 EPSS Score
- May 21, 2022 EPSS Score
- Jul 12, 2022 EPSS Score
- Oct 27, 2022 EPSS Score
- Dec 19, 2022 EPSS Score
- Feb 9, 2023 EPSS Score
- Apr 3, 2023 EPSS Score
- May 26, 2023 EPSS Score
- Jul 18, 2023 EPSS Score
- Oct 31, 2023 EPSS Score
References
- MDVSA-2012:019 vendor-advisory
- [oss-security] 20120208 Re: CVE request: apr - Hash DoS vulnerability mailing-list
- [apr-commits] 20120115 svn commit: r1231605 - /apr/apr/trunk/tables/apr_hash.c mailing-list
- http://svn.apache.org/viewvc?rev=1231605&view=rev url
- [dev] 20120113 Re: Hash collision vectors in APR? mailing-list
- http://www.mail-archive.com/dev%40apr.apache.org/msg24439.html technical
- https://nvd.nist.gov/vuln/detail/CVE-2012-0840 advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/73096 url
- http://mail-archives.apache.org/mod_mbox/apr-commits/201201.mbox/%3C20120115003715.071D423888FD@eris.apache.org%3E url
- http://openwall.com/lists/oss-security/2012/02/08/3 url
- http://secunia.com/advisories/47862 url
- http://www.mail-archive.com/dev%40apr.apache.org/msg24473.html url