Read the docs
TI-2012-02322 Aliases CVE-2012-2685GHSA-7whm-p3g6-xq8q

Cumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and Grid (MRG)…

Priority LOW 23CWE-399Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Partial
Fix status
Partial Red Hat: 10 fixed, 1 without a fix

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-399 and the CVSS impact.

Summary

Cumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and Grid (MRG) 2.0, allows remote authenticated users to cause a denial of service (memory consumption) via a large size in an image request.

Why it matters now

EPSS 0.02156 82nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial Red Hat: 2 advisoriesRed Hat: 10 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 21

CPEVersionsRoleVendor
cpe:2.3:a:trevor_mckay:cumin:*:*:*:*:*:*:*:*up to 0.1.5192-4VulnerableTrevor Mckay
cpe:2.3:a:trevor_mckay:cumin:0.1.3160-1:*:*:*:*:*:*:*0.1.3160-1VulnerableTrevor Mckay
cpe:2.3:a:trevor_mckay:cumin:0.1.4369-1:*:*:*:*:*:*:*0.1.4369-1VulnerableTrevor Mckay
cpe:2.3:a:trevor_mckay:cumin:0.1.4410-2:*:*:*:*:*:*:*0.1.4410-2VulnerableTrevor Mckay
cpe:2.3:a:trevor_mckay:cumin:0.1.4494-1:*:*:*:*:*:*:*0.1.4494-1VulnerableTrevor Mckay
cpe:2.3:a:trevor_mckay:cumin:0.1.4794-1:*:*:*:*:*:*:*0.1.4794-1VulnerableTrevor Mckay
cpe:2.3:a:trevor_mckay:cumin:0.1.4916-1:*:*:*:*:*:*:*0.1.4916-1VulnerableTrevor Mckay
cpe:2.3:a:trevor_mckay:cumin:0.1.5033-1:*:*:*:*:*:*:*0.1.5033-1VulnerableTrevor Mckay
cpe:2.3:a:trevor_mckay:cumin:0.1.5037-1:*:*:*:*:*:*:*0.1.5037-1VulnerableTrevor Mckay
cpe:2.3:a:trevor_mckay:cumin:0.1.5054-1:*:*:*:*:*:*:*0.1.5054-1VulnerableTrevor Mckay
  • cpe:2.3:a:trevor_mckay:cumin:*:*:*:*:*:*:*:* Versions up to 0.1.5192-4 Vulnerable ·Trevor Mckay
  • cpe:2.3:a:trevor_mckay:cumin:0.1.3160-1:*:*:*:*:*:*:* Versions 0.1.3160-1 Vulnerable ·Trevor Mckay
  • cpe:2.3:a:trevor_mckay:cumin:0.1.4369-1:*:*:*:*:*:*:* Versions 0.1.4369-1 Vulnerable ·Trevor Mckay
  • cpe:2.3:a:trevor_mckay:cumin:0.1.4410-2:*:*:*:*:*:*:* Versions 0.1.4410-2 Vulnerable ·Trevor Mckay
  • cpe:2.3:a:trevor_mckay:cumin:0.1.4494-1:*:*:*:*:*:*:* Versions 0.1.4494-1 Vulnerable ·Trevor Mckay
  • cpe:2.3:a:trevor_mckay:cumin:0.1.4794-1:*:*:*:*:*:*:* Versions 0.1.4794-1 Vulnerable ·Trevor Mckay
  • cpe:2.3:a:trevor_mckay:cumin:0.1.4916-1:*:*:*:*:*:*:* Versions 0.1.4916-1 Vulnerable ·Trevor Mckay
  • cpe:2.3:a:trevor_mckay:cumin:0.1.5033-1:*:*:*:*:*:*:* Versions 0.1.5033-1 Vulnerable ·Trevor Mckay
  • cpe:2.3:a:trevor_mckay:cumin:0.1.5037-1:*:*:*:*:*:*:* Versions 0.1.5037-1 Vulnerable ·Trevor Mckay
  • cpe:2.3:a:trevor_mckay:cumin:0.1.5054-1:*:*:*:*:*:*:* Versions 0.1.5054-1 Vulnerable ·Trevor Mckay
Show 11 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:trevor_mckay:cumin:0.1.5068-1:*:*:*:*:*:*:*0.1.5068-1VulnerableTrevor Mckay
cpe:2.3:a:trevor_mckay:cumin:0.1.5092-1:*:*:*:*:*:*:*0.1.5092-1VulnerableTrevor Mckay
cpe:2.3:a:trevor_mckay:cumin:0.1.5098-2:*:*:*:*:*:*:*0.1.5098-2VulnerableTrevor Mckay
cpe:2.3:a:trevor_mckay:cumin:0.1.5105-1:*:*:*:*:*:*:*0.1.5105-1VulnerableTrevor Mckay
cpe:2.3:a:trevor_mckay:cumin:0.1.5137-1:*:*:*:*:*:*:*0.1.5137-1VulnerableTrevor Mckay
cpe:2.3:a:trevor_mckay:cumin:0.1.5137-2:*:*:*:*:*:*:*0.1.5137-2VulnerableTrevor Mckay
cpe:2.3:a:trevor_mckay:cumin:0.1.5137-3:*:*:*:*:*:*:*0.1.5137-3VulnerableTrevor Mckay
cpe:2.3:a:trevor_mckay:cumin:0.1.5137-4:*:*:*:*:*:*:*0.1.5137-4VulnerableTrevor Mckay
cpe:2.3:a:trevor_mckay:cumin:0.1.5137-5:*:*:*:*:*:*:*0.1.5137-5VulnerableTrevor Mckay
cpe:2.3:a:trevor_mckay:cumin:0.1.5192-1:*:*:*:*:*:*:*0.1.5192-1VulnerableTrevor Mckay
cpe:2.3:o:redhat:enterprise_mrg:2.0:*:*:*:*:*:*:*2.0VulnerableRed Hat
  • cpe:2.3:a:trevor_mckay:cumin:0.1.5068-1:*:*:*:*:*:*:* Versions 0.1.5068-1 Vulnerable ·Trevor Mckay
  • cpe:2.3:a:trevor_mckay:cumin:0.1.5092-1:*:*:*:*:*:*:* Versions 0.1.5092-1 Vulnerable ·Trevor Mckay
  • cpe:2.3:a:trevor_mckay:cumin:0.1.5098-2:*:*:*:*:*:*:* Versions 0.1.5098-2 Vulnerable ·Trevor Mckay
  • cpe:2.3:a:trevor_mckay:cumin:0.1.5105-1:*:*:*:*:*:*:* Versions 0.1.5105-1 Vulnerable ·Trevor Mckay
  • cpe:2.3:a:trevor_mckay:cumin:0.1.5137-1:*:*:*:*:*:*:* Versions 0.1.5137-1 Vulnerable ·Trevor Mckay
  • cpe:2.3:a:trevor_mckay:cumin:0.1.5137-2:*:*:*:*:*:*:* Versions 0.1.5137-2 Vulnerable ·Trevor Mckay
  • cpe:2.3:a:trevor_mckay:cumin:0.1.5137-3:*:*:*:*:*:*:* Versions 0.1.5137-3 Vulnerable ·Trevor Mckay
  • cpe:2.3:a:trevor_mckay:cumin:0.1.5137-4:*:*:*:*:*:*:* Versions 0.1.5137-4 Vulnerable ·Trevor Mckay
  • cpe:2.3:a:trevor_mckay:cumin:0.1.5137-5:*:*:*:*:*:*:* Versions 0.1.5137-5 Vulnerable ·Trevor Mckay
  • cpe:2.3:a:trevor_mckay:cumin:0.1.5192-1:*:*:*:*:*:*:* Versions 0.1.5192-1 Vulnerable ·Trevor Mckay
  • cpe:2.3:o:redhat:enterprise_mrg:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Red Hat

Remediation

Red Hat 2 advisories

  • RHSA-2012:1281 Released 2012-09-19 · Red Hat rating Moderate
    Red Hat Enterprise MRG Grid 2.2 security update
    • Red Hat MRG Grid Execute Node for RHEL 6 ComputeNode v.2 condor-7.6.5-0.22.el6, condor-classads-7.6.5-0.22.el6, condor-kbdd-7.6.5-0.22.el6 +12
    • Red Hat MRG Grid Execute Node for RHEL 6 Server v.2 condor-7.6.5-0.22.el6, condor-classads-7.6.5-0.22.el6, condor-kbdd-7.6.5-0.22.el6 +10
    • Red Hat MRG Grid for RHEL 6 Server v.2 condor-7.6.5-0.22.el6, condor-aviary-7.6.5-0.22.el6, condor-classads-7.6.5-0.22.el6 +47
    • Red Hat MRG Management for RHEL 6 ComputeNode v.2 sesame-1.0-6.el6
    • Red Hat MRG Management for RHEL 6 Server v.2 cumin-0.1.5444-3.el6, python-wallaby-0.12.5-10.el6, sesame-1.0-6.el6 +1
    • Red Hat MRG Messaging for RHEL 6 Server v.2 sesame-1.0-6.el6
  • RHSA-2012:1278 Released 2012-09-19 · Red Hat rating Moderate
    Red Hat Enterprise MRG Grid 2.2 security update
    • MRG Grid Execute Node for RHEL 5 Server v.2 condor-7.6.5-0.22.el5, condor-7.6.5-0.22.el5.i386, condor-classads-7.6.5-0.22.el5 +15
    • MRG Grid for RHEL 5 Server v.2 condor-7.6.5-0.22.el5, condor-7.6.5-0.22.el5.i386, condor-aviary-7.6.5-0.22.el5 +21
    • MRG Management for RHEL 5 Server v.2 cumin-0.1.5444-3.el5, python-wallaby-0.12.5-10.el5, sesame-1.0-4.el5 +2
    • Red Hat MRG Messaging for RHEL 5 Server v.2 sesame-1.0-4.el5, sesame-1.0-4.el5.i386

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise MRG 1AffectedNo fix planned: Will not fix
MRG Grid Execute Node for RHEL 5 Server v.2Fixed RHSA-2012:1278
MRG Grid for RHEL 5 Server v.2Fixed RHSA-2012:1278
MRG Management for RHEL 5 Server v.2Fixed RHSA-2012:1278
Red Hat MRG Grid Execute Node for RHEL 6 ComputeNode v.2Fixed RHSA-2012:1281
Red Hat MRG Grid Execute Node for RHEL 6 Server v.2Fixed RHSA-2012:1281
Red Hat MRG Grid for RHEL 6 Server v.2Fixed RHSA-2012:1281
Red Hat MRG Management for RHEL 6 ComputeNode v.2Fixed RHSA-2012:1281
Red Hat MRG Management for RHEL 6 Server v.2Fixed RHSA-2012:1281
Red Hat MRG Messaging for RHEL 5 Server v.2Fixed RHSA-2012:1278
Red Hat MRG Messaging for RHEL 6 Server v.2Fixed RHSA-2012:1281

Timeline

  1. 2026-10-02 Threatist record created from CVE-2012-2685
  2. 2026-10-03 Alias added: GHSA-7whm-p3g6-xq8q

References

Exploit 1

Advisory 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences