Description
Plone 4.1.3 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | plone | < 4.1.4 | 4.1.4 | GHSA-pcwm-8jc3-qxvj |
References
- http://www.nruns.com/_downloads/advisory28122011.pdf
- plone-hash-dos(72018) vdb-entry
- VU#903934 third-party-advisory
- 20111228 n.runs-SA-2011.004 - web programming languages and platforms - DoS through hash table mailing-list
- 47406 third-party-advisory
- http://www.ocert.org/advisories/ocert-2011-003.html