First Last Prev Next    No search results available      Search page      Enter new bug
Bug#: 236060
Alias:
Product:
Component:
Status: RESOLVED
Resolution: FIXED
Assigned To: Gentoo Security <security@gentoo.org>
Hardware:
OS:
Version:
Priority:
Severity:
Reporter: Alex Legler <a3li@gentoo.org>
Add CC:
CC:
Remove selected CCs
URL:
Summary:
Status Whiteboard:
Keywords:
Flags: Requestee:
 
 
  ()

Filename Description Type Creator Created Size Actions
Create a New Attachment (proposed patch, testcase, etc.) View All

Bug 236060 depends on: 225465 Show dependency tree
Bug 236060 blocks:

Additional Comments: (this is where you put emerge --info)


Not eligible to see or edit group visibility for this bug.






View Bug Activity   |   Format For Printing   |   XML   |   Clone This Bug

Description:   Opened: 2008-08-28 20:11 0000 
The REXML module in Ruby 1.8.6 through 1.8.6-p287, 1.8.7 through 1.8.7-p72, and
1.9 allows context-dependent attackers to cause a denial of service (CPU
consumption) via an XML document with recursively nested entities, aka an "XML
entity explosion."


This issue is severe as especially but not exclusively most Rails deployments
are vulnerable to this DoS. Both upstream security and Rails staff are advising
users to apply a patch immediately.

There are two patches available:
 - A monkey patch to be applied in every application by the user [1]
 - A draft 'normal' patch to be applied once against the Ruby standard library
[2]

I suggest to apply the latter one in the ruby ebuilds.

[1]: http://weblog.rubyonrails.com/2008/8/23/dos-vulnerabilities-in-rexml
[2]: http://blade.nagaokaut.ac.jp/cgi-bin/scat.rb/ruby/ruby-core/18414

------- Comment #1 From Christian Hoffmann 2008-08-29 00:50:47 0000 ------- 
ruby team, please bump as necessary.

------- Comment #2 From Hans de Graaff 2008-08-29 06:26:07 0000 ------- 
ruby-1.8.6_p287-r1 has this patch applied and is currently in CVS. I'll
evaluate stabilizing this weekend, along with the other open ruby security
bugs.

------- Comment #3 From Robert Buchholz 2008-08-30 12:53:51 0000 ------- 
We'll handle stabling on bug 225465 as soon as appropriate.

------- Comment #4 From Robert Buchholz 2008-09-10 15:02:48 0000 ------- 
Hans, do I understand correctly we need to bump rails to 2.0.4 / 2.1.1 so it
can actually use the entity limit?
http://weblog.rubyonrails.org/2008/9/5/rails-2-1-1-lots-of-bug-fixes

------- Comment #5 From Hans de Graaff 2008-09-11 05:21:56 0000 ------- 
My understanding is that these versions of Rails contain a monkey patch for fix
the REXML problem. We already have this fixed in ruby 1.8.6_p287-r1, so the
monkey patch in these rails versions won't have any effect.

------- Comment #6 From Christian Hoffmann 2008-10-13 16:58:31 0000 ------- 
Updating whiteboard, fixed packages have been in the tree for some time already
(see 225465).
Security should vote on sending a GLSA or simply combining this issue with
above mentioned other bug.

------- Comment #7 From Tobias Heinlein 2008-10-13 18:44:55 0000 ------- 
Combining with the above mentioned bug since we already have a request for that
in the pool.

------- Comment #8 From Tobias Heinlein 2008-12-16 21:10:51 0000 ------- 
GLSA 200812-17, thanks everyone, sorry about the delay.
First Last Prev Next    No search results available      Search page      Enter new bug