CVE-2014-8090

The REXML parser in Ruby 1.9.x before 1.9.3 patchlevel 551, 2.0.x before 2.0.0 patchlevel 598, and 2.1.x before 2.1.5 allows remote attackers to cause a denial of service (CPU and memory consumption) a crafted XML document containing an empty string in an entity that is used in a large number of nested entity references, aka an XML Entity Expansion (XEE) attack.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-1821 and CVE-2014-8080.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:N/C:N/I:N/A:P
Base Score
CVSS 3.x
EPSS Score
Percentile: 93%
Affected Products (NVD)
VendorProductVersion
ruby-langruby
𝑥
≤ 1.9.3
ruby-langruby
1.9.3
ruby-langruby
1.9.3:p0
ruby-langruby
1.9.3:p125
ruby-langruby
1.9.3:p194
ruby-langruby
1.9.3:p286
ruby-langruby
1.9.3:p383
ruby-langruby
1.9.3:p385
ruby-langruby
1.9.3:p392
ruby-langruby
1.9.3:p426
ruby-langruby
1.9.3:p429
ruby-langruby
1.9.3:p448
ruby-langruby
1.9.3:p545
ruby-langruby
1.9.3:p547
ruby-langruby
2.0.0
ruby-langruby
2.0.0:p0
ruby-langruby
2.0.0:p195
ruby-langruby
2.0.0:p247
ruby-langruby
2.0.0:p451
ruby-langruby
2.0.0:p481
ruby-langruby
2.0.0:p576
ruby-langruby
2.0.0:p594
ruby-langruby
2.1.1
ruby-langruby
2.1.2
ruby-langruby
2.1.3
ruby-langruby
2.1.4
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
ruby1.8
lucid
ignored
precise
Fixed 1.8.7.352-2ubuntu1.6
released
trusty
dne
utopic
dne
vivid
dne
wily
dne
ruby1.9.1
lucid
ignored
precise
Fixed 1.9.3.0-1ubuntu2.10
released
trusty
Fixed 1.9.3.484-2ubuntu1.2
released
utopic
ignored
vivid
ignored
wily
dne
ruby2.0
lucid
dne
precise
dne
trusty
Fixed 2.0.0.484-1ubuntu2.2
released
utopic
Fixed 2.0.0.484+really457-3ubuntu1.2
released
vivid
dne
wily
dne
ruby2.1
lucid
dne
precise
dne
trusty
dne
utopic
Fixed 2.1.2-2ubuntu1.2
released
vivid
Fixed 2.1.2-2ubuntu3
released
wily
Fixed 2.1.2-2ubuntu3
released
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
libruby2_1-2_1
suse enterprise sap 12
2.1.2-9.1
fixed
suse enterprise sap 12 SP5
2.1.9-18.1
fixed
suse enterprise server 12
2.1.2-9.1
fixed
suse enterprise server 12 SP2
2.1.2-12.3
fixed
suse enterprise server 12 SP3
2.1.9-18.1
fixed
suse enterprise server 12 SP4
2.1.9-18.1
fixed
suse enterprise server 12 SP5
2.1.9-18.1
fixed
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
ruby
RHEL 6
0:1.8.7.374-3.el6_6
fixed
RHEL 7
0:2.0.0.353-22.el7_0
fixed
ruby-devel
RHEL 6
0:1.8.7.374-3.el6_6
fixed
RHEL 7
0:2.0.0.353-22.el7_0
fixed
ruby-doc
RHEL 7
0:2.0.0.353-22.el7_0
fixed
ruby-docs
RHEL 6
0:1.8.7.374-3.el6_6
fixed
ruby-irb
RHEL 6
0:1.8.7.374-3.el6_6
fixed
RHEL 7
0:2.0.0.353-22.el7_0
fixed
ruby-libs
RHEL 6
0:1.8.7.374-3.el6_6
fixed
RHEL 7
0:2.0.0.353-22.el7_0
fixed
ruby-rdoc
RHEL 6
0:1.8.7.374-3.el6_6
fixed
ruby-ri
RHEL 6
0:1.8.7.374-3.el6_6
fixed
ruby-static
RHEL 6
0:1.8.7.374-3.el6_6
fixed
ruby-tcltk
RHEL 6
0:1.8.7.374-3.el6_6
fixed
RHEL 7
0:2.0.0.353-22.el7_0
fixed
rubygem-bigdecimal
RHEL 7
0:1.2.0-22.el7_0
fixed
rubygem-io-console
RHEL 7
0:0.4.2-22.el7_0
fixed
rubygem-json
RHEL 7
0:1.7.7-22.el7_0
fixed
rubygem-minitest
RHEL 7
0:4.3.2-22.el7_0
fixed
rubygem-psych
RHEL 7
0:2.0.0-22.el7_0
fixed
rubygem-rake
RHEL 7
0:0.9.6-22.el7_0
fixed
rubygem-rdoc
RHEL 7
0:4.0.0-22.el7_0
fixed
rubygems
RHEL 7
0:2.0.14-22.el7_0
fixed
rubygems-devel
RHEL 7
0:2.0.14-22.el7_0
fixed
References
http://advisories.mageia.org/MGASA-2014-0472.html
http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html
http://lists.opensuse.org/opensuse-updates/2014-12/msg00035.html
http://lists.opensuse.org/opensuse-updates/2015-01/msg00000.html
http://lists.opensuse.org/opensuse-updates/2015-01/msg00004.html
http://rhn.redhat.com/errata/RHSA-2014-1911.html
http://rhn.redhat.com/errata/RHSA-2014-1912.html
http://rhn.redhat.com/errata/RHSA-2014-1913.html
http://rhn.redhat.com/errata/RHSA-2014-1914.html
http://secunia.com/advisories/59948
http://secunia.com/advisories/62050
http://secunia.com/advisories/62748
http://www.debian.org/security/2015/dsa-3157
http://www.debian.org/security/2015/dsa-3159
http://www.mandriva.com/security/advisories?name=MDVSA-2015:129
http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
http://www.securityfocus.com/bid/71230
http://www.ubuntu.com/usn/USN-2412-1
https://support.apple.com/HT205267
https://www.ruby-lang.org/en/news/2014/11/13/rexml-dos-cve-2014-8090/
http://advisories.mageia.org/MGASA-2014-0472.html
http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html
http://lists.opensuse.org/opensuse-updates/2014-12/msg00035.html
http://lists.opensuse.org/opensuse-updates/2015-01/msg00000.html
http://lists.opensuse.org/opensuse-updates/2015-01/msg00004.html
http://rhn.redhat.com/errata/RHSA-2014-1911.html
http://rhn.redhat.com/errata/RHSA-2014-1912.html
http://rhn.redhat.com/errata/RHSA-2014-1913.html
http://rhn.redhat.com/errata/RHSA-2014-1914.html
http://secunia.com/advisories/59948
http://secunia.com/advisories/62050
http://secunia.com/advisories/62748
http://www.debian.org/security/2015/dsa-3157
http://www.debian.org/security/2015/dsa-3159
http://www.mandriva.com/security/advisories?name=MDVSA-2015:129
http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
http://www.securityfocus.com/bid/71230
http://www.ubuntu.com/usn/USN-2412-1
https://support.apple.com/HT205267
https://www.ruby-lang.org/en/news/2014/11/13/rexml-dos-cve-2014-8090/