CVE-2012-0785 — Hash collision attack vulnerability in Jenkins

Description

Hash collision attack vulnerability in Jenkins before 1.447, Jenkins LTS before 1.424.2, and Jenkins Enterprise by CloudBees 1.424.x before 1.424.2.1 and 1.400.x before 1.400.0.11 could allow remote attackers to cause a considerable CPU load, aka "the Hash DoS attack."

Affected products

Vendor	Product	Affected	Fixed
Jenkins project	Jenkins	before 1.447	—
Jenkins project	Jenkins LTS	before 1.424.2	—
Jenkins project	Jenkins Enterprise by CloudBees	1.424.x before 1.424.2.1, 1.400.x before 1.400.0.11	—

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	org.jenkins-ci.main:jenkins-core	>= 1.425, < 1.447	1.447	GHSA-pchp-c5w8-47gc
Maven	org.jenkins-ci.main:jenkins-core	< 1.424.2	1.424.2	GHSA-pchp-c5w8-47gc

References

[oss-security] 20120119 Re: CVE request: Jenkins mailing-list
https://security-tracker.debian.org/tracker/CVE-2012-0785
https://access.redhat.com/security/cve/cve-2012-0785
https://jenkins.io/security/advisory/2012-01-12/
https://www.cloudbees.com/jenkins-security-advisory-2012-01-12