Unscored CVE-2012-1035 EUVD-2012-1073GHSA-j3v8-j93f-cg82

AdaCore Ada Web Services (AWS) before 2.10.2 computes hash values for form parameters without restricting the ability to trigger hash colli…

Published Feb 8, 2012 · Updated Sep 16, 2024 · Assigned by mitre

Description

AdaCore Ada Web Services (AWS) before 2.10.2 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.

References

http://www.nruns.com/_downloads/advisory28122011.pdf
http://www.adacore.com/2012/01/27/security-advisory-sa-2012-l119-003-hash-collisions-in-aws/
20120127 AdaCore Security Advisory SA-2012-L119-003 Hash collisions in AWS mailing-list
http://www.ocert.org/advisories/ocert-2011-003.html