CVE-2012-0840: Input Validation
Apache APR is vulnerable to a denial of service, caused by insufficient randomization of hash data structures. By sending multiple specially-crafted HTTP POST requests to an affected application containing conflicting hash key values, a remote attacker could exploit this vulnerability to cause the consumption of CPU resources.
Other sources
tables/aprhash.c in the Apache Portable Runtime (APR) library through 1.4.5 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2012-0840?
CVE-2012-0840 is classified as a high severity vulnerability due to its potential for causing a denial of service.
How do I fix CVE-2012-0840?
To fix CVE-2012-0840, upgrade to a patched version of Apache Portable Runtime newer than 1.4.5.
Which versions of Apache Portable Runtime are affected by CVE-2012-0840?
CVE-2012-0840 affects Apache Portable Runtime versions up to and including 1.4.5 and specific 0.9.x versions.
Can CVE-2012-0840 be exploited remotely?
Yes, CVE-2012-0840 can be exploited remotely by sending specially-crafted HTTP POST requests.
What type of attack does CVE-2012-0840 enable?
CVE-2012-0840 enables a denial of service attack due to insufficient randomization of hash data structures.