Bug 458776 – <dev-lang/ruby-1.9.3_p392: DoS vulnerabilities (CVE-2013-{0269,1821})

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Hans de Graaff 2013-02-22 18:57:06 UTC]

http://www.ruby-lang.org/en/news/2013/02/22/json-dos-cve-2013-0269/

http://www.ruby-lang.org/en/news/2013/02/22/rexml-dos-2013-02-22/

[Comment 1 Hans de Graaff 2013-02-22 19:22:14 UTC]

Now in the tree:

=dev-lang/ruby-1.9.3_p392

[Comment 2 Sean Amoss (RETIRED) 2013-02-23 16:37:24 UTC]

(In reply to comment #1)
> Now in the tree:
> 
> =dev-lang/ruby-1.9.3_p392

Thanks, Hans.

Arches, please test and mark stable. 

Target KEYWORDS: "alpha amd64 arm hppa ia64 ~mips ppc ppc64 s390 sh sparc x86 ~x86-fbsd"

[Comment 3 Agostino Sarubbo 2013-02-23 21:11:33 UTC]

ppc stable

[Comment 4 Agostino Sarubbo 2013-02-23 22:02:45 UTC]

ppc64 stable

[Comment 5 Agostino Sarubbo 2013-02-24 12:12:59 UTC]

amd64 stable

[Comment 6 Agostino Sarubbo 2013-02-24 12:16:11 UTC]

x86 stable

[Comment 7 Agostino Sarubbo 2013-02-24 15:08:26 UTC]

ia64 stable

[Comment 8 Agostino Sarubbo 2013-02-24 17:21:50 UTC]

hppa stable

[Comment 9 Agostino Sarubbo 2013-02-24 18:50:54 UTC]

sparc stable

[Comment 10 Agostino Sarubbo 2013-02-24 19:49:15 UTC]

s390 stable

[Comment 11 Agostino Sarubbo 2013-02-24 19:57:14 UTC]

arm stable

[Comment 12 Agostino Sarubbo 2013-02-26 10:22:00 UTC]

alpha stable

[Comment 13 Agostino Sarubbo 2013-02-26 18:52:56 UTC]

sh stable

[Comment 14 Sean Amoss (RETIRED) 2013-03-03 21:31:19 UTC]

GLSA vote: yes.

[Comment 15 GLSAMaker/CVETool Bot 2013-03-04 23:21:51 UTC]

CVE-2013-0269 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-0269):
  The JSON gem 1.7.x before 1.7.7, 1.6.x before 1.6.8, and 1.5.x before 1.5.5
  allows remote attackers to cause a denial of service (resource consumption)
  or bypass the mass assignment protection mechanism via a crafted JSON
  document that triggers the creation of arbitrary Ruby symbols or certain
  internal objects, as demonstrated by conducting a SQL injection attack
  against Ruby on Rails, aka "Unsafe Object Creation Vulnerability."

[Comment 16 GLSAMaker/CVETool Bot 2013-04-11 16:57:36 UTC]

CVE-2013-1821 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1821):
  lib/rexml/text.rb in the REXML parser in Ruby before 1.9.3-p392 allows
  remote attackers to cause a denial of service (memory consumption and crash)
  via crafted text nodes in an XML document, aka an XML Entity Expansion (XEE)
  attack.

[Comment 17 Yury German 2014-06-19 02:57:37 UTC]

GLSA Vote: Yes
Added to an existing GLSA request.

[Comment 18 GLSAMaker/CVETool Bot 2014-12-13 19:23:53 UTC]

This issue was resolved and addressed in
 GLSA 201412-27 at http://security.gentoo.org/glsa/glsa-201412-27.xml
by GLSA coordinator Sean Amoss (ackle).