Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 527084 (CVE-2014-8080) - <dev-lang/ruby-{1.9.3_p550,2.0.0_p594,2.1.4}: Denial Of Service XML Expansion (CVE-2014-8080)
Summary: <dev-lang/ruby-{1.9.3_p550,2.0.0_p594,2.1.4}: Denial Of Service XML Expansion...
Status: RESOLVED FIXED
Alias: CVE-2014-8080
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL: https://bugzilla.redhat.com/show_bug....
Whiteboard: B3 [glsa]
Keywords:
Depends on:
Blocks:
 
Reported: 2014-10-27 14:39 UTC by Agostino Sarubbo
Modified: 2014-12-13 19:24 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2014-10-27 14:39:56 UTC 
From ${URL} :

Upstream released new version of Ruby [1] which fixes DoS during XML expansion.
Upstream commit fixing this: http://svn.ruby-lang.org/cgi-bin/viewvc.cgi/?pathrev=48161

[1]: https://www.ruby-lang.org/en/news/2014/10/27/rexml-dos-cve-2014-8080/


@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.
Comment 1 Hans de Graaff gentoo-dev Security 2014-10-27 19:19:08 UTC 
Upstream announcement: https://www.ruby-lang.org/en/news/2014/10/27/rexml-dos-cve-2014-8080/

Now in the tree:

ruby-1.9.3_p550
ruby-2.0.0_p594
ruby-2.1.4

Since ruby-2.0.0_p594 and ruby-2.1.4 both contain bug fixes in addition to security fixes my suggestion would be to wait a few days before marking these as stable so we can shake out any unexpected issues first.
Comment 2 Hans de Graaff gentoo-dev Security 2014-11-02 10:37:20 UTC 
No problems have been reported so we are good to go for stabilization:

=dev-lang/ruby-1.9.3_p550
=dev-lang/ruby-2.0.0_p594
Comment 3 Jeroen Roovers (RETIRED) gentoo-dev 2014-11-02 19:22:51 UTC 
Stable for HPPA.
Comment 4 Agostino Sarubbo gentoo-dev 2014-11-05 11:34:11 UTC 
amd64 stable
Comment 5 Agostino Sarubbo gentoo-dev 2014-11-05 11:34:27 UTC 
x86 stable
Comment 6 Markus Meier gentoo-dev 2014-11-05 18:22:29 UTC 
arm stable
Comment 7 Agostino Sarubbo gentoo-dev 2014-11-10 10:47:14 UTC 
ppc stable
Comment 8 Agostino Sarubbo gentoo-dev 2014-11-10 10:47:30 UTC 
ppc64 stable
Comment 9 Agostino Sarubbo gentoo-dev 2014-11-11 10:35:37 UTC 
ia64 stable
Comment 10 Agostino Sarubbo gentoo-dev 2014-11-11 10:35:53 UTC 
sparc stable
Comment 11 Agostino Sarubbo gentoo-dev 2014-11-12 16:55:57 UTC 
alpha stable.

Maintainer(s), please cleanup.
Security, please vote.
Comment 12 Hans de Graaff gentoo-dev Security 2014-11-14 06:35:25 UTC 
Vulnerable versions have now been removed.
Comment 13 GLSAMaker/CVETool Bot gentoo-dev 2014-11-23 04:19:52 UTC 
CVE-2014-8080 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-8080):
  The REXML parser in Ruby 1.9.x before 1.9.3-p550, 2.0.x before 2.0.0-p594,
  and 2.1.x before 2.1.4 allows remote attackers to cause a denial of service
  (memory consumption) via a crafted XML document, aka an XML Entity Expansion
  (XEE) attack.
Comment 14 Yury German Gentoo Infrastructure gentoo-dev 2014-11-23 04:34:09 UTC 
Arches and Mainter(s), Thank you for your work.

Added to an existing GLSA request.
Comment 15 GLSAMaker/CVETool Bot gentoo-dev 2014-12-13 19:24:16 UTC 
This issue was resolved and addressed in
 GLSA 201412-27 at http://security.gentoo.org/glsa/glsa-201412-27.xml
by GLSA coordinator Sean Amoss (ackle).