CVE-2012-5370 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-5370): JRuby computes hash values without properly restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table, as demonstrated by a universal multicollision attack against the MurmurHash2 algorithm, a different vulnerability than CVE-2011-4838.
As far as I can tell this is fixed in jruby 1.7.1, but we are still providing 1.6.x.
jruby 1.6 is now masked for removal.
(In reply to Hans de Graaff from comment #2) > jruby 1.6 is now masked for removal. Thank you
jruby 1.6.x was removed some time ago.
Per previous comments the vulnerable version was removed. Following links verify that: http://jruby.org/2012/12/03/jruby-1-7-1 https://bugzilla.redhat.com/show_bug.cgi?id=880671