Bug 529216 – <dev-lang/ruby-{1.9.3_p551,2.0.0_p598,2.1.5}: Denial Of Service XML Expansion (CVE-2014-8090)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Hans de Graaff 2014-11-14 06:41:23 UTC]

Unrestricted entity expansion can lead to a DoS vulnerability in REXML, like “Entity expansion DoS vulnerability in REXML (XML bomb, CVE-2013-1821)” and “CVE-2014-8080: Parameter Entity expansion DoS vulnerability in REXML”. This vulnerability has been assigned the CVE identifier CVE-2014-8090. We strongly recommend to upgrade Ruby.

[Comment 1 GLSAMaker/CVETool Bot 2014-11-23 04:39:31 UTC]

CVE-2014-8090 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-8090):
  The REXML parser in Ruby 1.9.x before 1.9.3 patchlevel 551, 2.0.x before
  2.0.0 patchlevel 598, and 2.1.x before 2.1.5 allows remote attackers to
  cause a denial of service (CPU and memory consumption) a crafted XML
  document containing an empty string in an entity that is used in a large
  number of nested entity references, aka an XML Entity Expansion (XEE)
  attack.  NOTE: this vulnerability exists because of an incomplete fix for
  CVE-2013-1821 and CVE-2014-8080.

[Comment 2 Yury German 2014-11-23 05:39:43 UTC]

All versions mentioned are in the tree. Please advise when you are ready for stabilization.

[Comment 3 Hans de Graaff 2014-11-26 07:01:29 UTC]

Please test and mark stable:

=dev-lang/ruby-1.9.3_p551
=dev-lang/ruby-2.0.0_p598

[Comment 4 Agostino Sarubbo 2014-11-26 14:31:50 UTC]

amd64 stable

[Comment 5 Agostino Sarubbo 2014-11-26 14:32:06 UTC]

x86 stable

[Comment 6 Jeroen Roovers (RETIRED) 2014-11-26 16:59:13 UTC]

Stable for HPPA.

[Comment 7 Agostino Sarubbo 2014-11-28 14:02:22 UTC]

ppc stable

[Comment 8 Agostino Sarubbo 2014-11-28 14:02:39 UTC]

ppc64 stable

[Comment 9 Markus Meier 2014-11-29 19:49:55 UTC]

arm stable

[Comment 10 Agostino Sarubbo 2014-12-01 08:58:32 UTC]

sparc stable

[Comment 11 Agostino Sarubbo 2014-12-02 11:58:48 UTC]

alpha stable

[Comment 12 Agostino Sarubbo 2014-12-06 16:52:08 UTC]

ia64 stable.

Maintainer(s), please cleanup.
Security, please vote.

[Comment 13 Hans de Graaff 2014-12-07 07:18:56 UTC]

Cleanup done.

[Comment 14 Yury German 2014-12-07 18:59:18 UTC]

Arches and Mainter(s), Thank you for your work.

Added to an existing GLSA request.

[Comment 15 GLSAMaker/CVETool Bot 2014-12-13 19:24:24 UTC]

This issue was resolved and addressed in
 GLSA 201412-27 at http://security.gentoo.org/glsa/glsa-201412-27.xml
by GLSA coordinator Sean Amoss (ackle).