CVE-2012-0785

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

Hash collision attack vulnerability in Jenkins before 1.447, Jenkins LTS before 1.424.2, and Jenkins Enterprise by CloudBees 1.424.x before 1.424.2.1 and 1.400.x before 1.400.0.11 could allow remote attackers to cause a considerable CPU load, aka "the Hash DoS attack."

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

Vendor	Product	Versions
Jenkins project	Jenkins	before 1.447
Jenkins project	Jenkins LTS	before 1.424.2
Jenkins project	Jenkins Enterprise by CloudBees	1.424.x before 1.424.2.1; 1.400.x before 1.400.0.11

References

http://www.openwall.com/lists/oss-security/2012/01/20/8Mailing List, Third Party Advisory
https://access.redhat.com/security/cve/cve-2012-0785Broken Link
https://jenkins.io/security/advisory/2012-01-12/Vendor Advisory
https://security-tracker.debian.org/tracker/CVE-2012-0785Third Party Advisory
https://www.cloudbees.com/jenkins-security-advisory-2012-01-12Third Party Advisory
http://www.openwall.com/lists/oss-security/2012/01/20/8Mailing List, Third Party Advisory
https://access.redhat.com/security/cve/cve-2012-0785Broken Link
https://jenkins.io/security/advisory/2012-01-12/Vendor Advisory
https://security-tracker.debian.org/tracker/CVE-2012-0785Third Party Advisory
https://www.cloudbees.com/jenkins-security-advisory-2012-01-12Third Party Advisory

Timeline

Published: Feb 24, 2020
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2012

CVE-2012-07863.3The transform_save function in transform.c in Augeas before 1.0.0 allows local users to overwrite arbitrary files and obtain sensitive infor CVE-2012-07873.7The clone_file function in transfer.c in Augeas before 1.0.0, when copy_if_rename_fails is set and EXDEV or EBUSY is returned by the rename CVE-2012-07885.0The PDORow implementation in PHP before 5.3.9 does not properly interact with the session feature, which allows remote attackers to cause a CVE-2012-07895.0Memory leak in the timezone functionality in PHP before 5.3.9 allows remote attackers to cause a denial of service (memory consumption) by t CVE-2012-07904.3Cross-site scripting (XSS) vulnerability in smokeping_cgi in Smokeping 2.4.2, 2.6.6, and other versions before 2.6.7 allows remote attackers CVE-2012-07914.3Multiple cross-site scripting (XSS) vulnerabilities in Horde IMP before 5.0.18 and Horde Groupware Webmail Edition before 4.0.6 allow remote CVE-2012-07924.0mod/forum/user.php in Moodle 1.9.x before 1.9.16 allows remote authenticated users to obtain the names and other details of arbitrary user a CVE-2012-07935.0Moodle 1.9.x before 1.9.16, 2.0.x before 2.0.7, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 allows remote attackers to view the profile image CVE-2012-07945.0The rc4encrypt function in lib/moodlelib.php in Moodle 1.9.x before 1.9.16, 2.0.x before 2.0.7, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 u CVE-2012-07956.5Moodle 1.9.x before 1.9.16, 2.0.x before 2.0.7, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 does not validate e-mail address settings, which CVE-2012-07964.0class.phpmailer.php in the PHPMailer library, as used in Moodle 1.9.x before 1.9.16, 2.0.x before 2.0.7, 2.1.x before 2.1.4, and 2.2.x befor CVE-2012-07975.5The webservices functionality in Moodle 2.0.x before 2.0.7, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 allows remote authenticated users to