Ruby CVE-2014-8090 Incomplete Fix XML External Entity Denial of Service Vulnerability

Bugtraq ID:	71230
Class:	Input Validation Error
CVE:	CVE-2014-8090
Remote:	Yes
Local:	No
Published:	Nov 21 2014 12:00AM
Updated:	Jul 05 2016 09:28PM
Credit:	Tomas Hoger
Vulnerable:	Ubuntu Ubuntu Linux 12.04 LTS i386 Ubuntu Ubuntu Linux 12.04 LTS amd64 Red Hat Enterprise Linux Workstation Optional 6 Red Hat Enterprise Linux Workstation 6 Red Hat Enterprise Linux Server Optional 6 Red Hat Enterprise Linux Server 6 Red Hat Enterprise Linux HPC Node Optional 6 Red Hat Enterprise Linux HPC Node 6 Red Hat Enterprise Linux Desktop Optional 6 Red Hat Enterprise Linux Desktop 6 Oracle Enterprise Linux 6.2 Oracle Enterprise Linux 6 Gentoo Linux Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64 CentOS CentOS 6 Apple Mac Os X 10.7.4 Apple Mac Os X 10.7.3 Apple Mac Os X 10.7.1
Not Vulnerable:

Ruby CVE-2014-8090 Incomplete Fix XML External Entity Denial of Service Vulnerability

Ruby is prone to a denial-of-service vulnerability.

An attacker can exploit this issue to cause a denial-of-service condition.

The following versions are vulnerable:

Ruby 1.9 versions prior to 1.9.3-p551
Ruby 2.0 versions prior to 2.0.0-p598
Ruby 2.1 versions prior to 2.1.5

Note: This issue is the result of an incomplete fix for the issues described in 58141 (Ruby REXML Parser Denial of Service Vulnerability) and 70935 (Ruby CVE-2014-8080 XML External Entity Denial of Service Vulnerability).

Ruby CVE-2014-8090 Incomplete Fix XML External Entity Denial of Service Vulnerability

An attacker can exploit this issue using readily available tools.

Ruby CVE-2014-8090 Incomplete Fix XML External Entity Denial of Service Vulnerability

References:

• CVE-2014-8090: Another Denial of Service XML Expansion (Ruby-Lang)
  
• Oracle Linux Bulletin - January 2016 (Oracle)
  
• Ruby-Lang Homepage (Ruby-Lang)