CVE-2011-5034

描述

Apache Geronimo 2.2.1 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters. NOTE: this might overlap CVE-2011-4461.

如何修補 CVE-2011-5034

要修補 CVE-2011-5034,請將受影響套件升級到下列已修補版本。

• Maven/org.apache.geronimo:geronimo—升級至 2.2.1 或更新版本

CVE-2011-5034 正在被利用嗎?

可能 — EPSS 為 81.2%,屬於高被利用機率區間,建議優先修補。

受影響套件(1)

• from 0, < 2.2.1

參考連結(18)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2011-5034
• PATCHgithub.com/apache/geronimo
• WEBwww.kb.cert.org/vuls/id/903934
• WEBwww.ocert.org/advisories/ocert-2011-003.html
• WEB