Django REST framework

Lookup for vulnerabilities affecting packages.

Vulnerability_id VCID-hxfx-e71r-9ye8

Summary

Hash Collision Form Parameter Parsing Remote DoS
This package contains a flaw that may allow a remote denial of service. The issue is triggered when an attacker sends multiple crafted parameters which trigger hash collisions, and will result in loss of availability for the program via CPU consumption.

Aliases

alias	CVE-2011-5036

Fixed_packages

url	pkg:gem/rack@1.1.3
purl	pkg:gem/rack@1.1.3
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:gem/rack@1.1.3

url	pkg:gem/rack@1.2.5
purl	pkg:gem/rack@1.2.5
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:gem/rack@1.2.5

url	pkg:gem/rack@1.3.6
purl	pkg:gem/rack@1.3.6
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:gem/rack@1.3.6

url pkg:gem/rack@1.4.0

purl pkg:gem/rack@1.4.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-6dhj-xgsb-nkhd

vulnerability	VCID-w1cf-9x6v-pyhw

resource_url http://public2.vulnerablecode.io/packages/pkg:gem/rack@1.4.0

Affected_packages

url pkg:gem/rack@1.2.0

purl pkg:gem/rack@1.2.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-hxfx-e71r-9ye8

vulnerability	VCID-w1cf-9x6v-pyhw

resource_url http://public2.vulnerablecode.io/packages/pkg:gem/rack@1.2.0

url pkg:gem/rack@1.3.0.beta

purl pkg:gem/rack@1.3.0.beta

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-hxfx-e71r-9ye8

resource_url http://public2.vulnerablecode.io/packages/pkg:gem/rack@1.3.0.beta

References

reference_url	http://osvdb.org/show/osvdb/78121
reference_id
reference_type
scores
url	http://osvdb.org/show/osvdb/78121

reference_url	https://github.com/rack/rack/commit/09c5e53f11a491c25bef873ed146842f3cd03228
reference_id
reference_type
scores
url	https://github.com/rack/rack/commit/09c5e53f11a491c25bef873ed146842f3cd03228

Weaknesses

cwe_id	1035
name	OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.

cwe_id	310
name	Cryptographic Issues
description	Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.

cwe_id	937
name	OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.

Exploits

Severity_range_score null

Exploitability null

Weighted_severity null

Risk_score null

Resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-hxfx-e71r-9ye8

Vulnerability Instance