CVE-2014-8090
Fixed in a distro release EPSS 6%
The REXML parser in Ruby 1.9.x before 1.9.3 patchlevel 551, 2.0.x before 2.0.0 patchlevel 598, and 2.1.x before 2.1.5 allows remote attackers to cause a denial of service (CPU and memory consumption) a crafted XML document containing an empty string in an entity that is used in a large number of nested entity references, aka an XML Entity Expansion (XEE) attack. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-1821 and CVE-2014-8080.
Products: ruby-lang ruby
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 6.0 | ruby1.8 | 1.8.7.302-2squeeze3 |
| Debian 6.0 | ruby1.9.1 | 1.9.2.0-2+deb6u3 |
| Debian 7 | ruby1.8 | 1.8.7.358-7.1+deb7u2 |
| Debian 7 | ruby1.9.1 | 1.9.3.194-8.1+deb7u3 |
| Red Hat Enterprise Linux 6 | ruby | 0:1.8.7.374-3.el6_6 |
| Red Hat Enterprise Linux 6 | ruby-debuginfo | 0:1.8.7.374-3.el6_6 |
| Red Hat Enterprise Linux 6 | ruby-devel | 0:1.8.7.374-3.el6_6 |
| Red Hat Enterprise Linux 6 | ruby-docs | 0:1.8.7.374-3.el6_6 |
| Red Hat Enterprise Linux 6 | ruby-irb | 0:1.8.7.374-3.el6_6 |
| Red Hat Enterprise Linux 6 | ruby-libs | 0:1.8.7.374-3.el6_6 |
| Red Hat Enterprise Linux 6 | ruby-rdoc | 0:1.8.7.374-3.el6_6 |
| Red Hat Enterprise Linux 6 | ruby-ri | 0:1.8.7.374-3.el6_6 |
| Red Hat Enterprise Linux 6 | ruby-static | 0:1.8.7.374-3.el6_6 |
| Red Hat Enterprise Linux 6 | ruby-tcltk | 0:1.8.7.374-3.el6_6 |
| Red Hat Enterprise Linux 7 | ruby | 0:2.0.0.353-22.el7_0 |
| Red Hat Enterprise Linux 7 | ruby-debuginfo | 0:2.0.0.353-22.el7_0 |
| Red Hat Enterprise Linux 7 | ruby-devel | 0:2.0.0.353-22.el7_0 |
| Red Hat Enterprise Linux 7 | ruby-doc | 0:2.0.0.353-22.el7_0 |
| Red Hat Enterprise Linux 7 | ruby-irb | 0:2.0.0.353-22.el7_0 |
| Red Hat Enterprise Linux 7 | ruby-libs | 0:2.0.0.353-22.el7_0 |
| Red Hat Enterprise Linux 7 | ruby-tcltk | 0:2.0.0.353-22.el7_0 |
| Red Hat Enterprise Linux 7 | rubygem-bigdecimal | 0:1.2.0-22.el7_0 |
| Red Hat Enterprise Linux 7 | rubygem-io-console | 0:0.4.2-22.el7_0 |
| Red Hat Enterprise Linux 7 | rubygem-json | 0:1.7.7-22.el7_0 |
| Red Hat Enterprise Linux 7 | rubygem-minitest | 0:4.3.2-22.el7_0 |
| Red Hat Enterprise Linux 7 | rubygem-psych | 0:2.0.0-22.el7_0 |
| Red Hat Enterprise Linux 7 | rubygem-rake | 0:0.9.6-22.el7_0 |
| Red Hat Enterprise Linux 7 | rubygem-rdoc | 0:4.0.0-22.el7_0 |
| Red Hat Enterprise Linux 7 | rubygems | 0:2.0.14-22.el7_0 |
| Red Hat Enterprise Linux 7 | rubygems-devel | 0:2.0.14-22.el7_0 |
| Red Hat hummingbird 1 | ruby3.3 | 0:3.3.10-23.1.hum1 |
| Red Hat hummingbird 1 | ruby3.3-bundled-gems | 0:3.3.10-23.1.hum1 |
| Red Hat hummingbird 1 | ruby3.3-default-gems | 0:3.3.10-23.1.hum1 |
| Red Hat hummingbird 1 | ruby3.3-devel | 0:3.3.10-23.1.hum1 |
| Red Hat hummingbird 1 | ruby3.3-doc | 0:3.3.10-23.1.hum1 |
| Red Hat hummingbird 1 | ruby3.3-libs | 0:3.3.10-23.1.hum1 |
| Red Hat hummingbird 1 | ruby3.4 | 0:3.4.8-31.1.hum1 |
| Red Hat hummingbird 1 | ruby3.4-bundled-gems | 0:3.4.8-31.1.hum1 |
| Red Hat hummingbird 1 | ruby3.4-default-gems | 0:3.4.8-31.1.hum1 |
| Red Hat hummingbird 1 | ruby3.4-devel | 0:3.4.8-31.1.hum1 |
| Red Hat hummingbird 1 | ruby3.4-doc | 0:3.4.8-31.1.hum1 |
| Red Hat hummingbird 1 | ruby3.4-libs | 0:3.4.8-31.1.hum1 |
| Red Hat hummingbird 1 | ruby4.0 | 0:4.0.0-33.3.hum1 |
| Red Hat hummingbird 1 | ruby4.0-bundled-gems | 0:4.0.0-33.3.hum1 |
| Red Hat hummingbird 1 | ruby4.0-default-gems | 0:4.0.0-33.3.hum1 |
| Red Hat hummingbird 1 | ruby4.0-devel | 0:4.0.0-33.3.hum1 |
| Red Hat hummingbird 1 | ruby4.0-doc | 0:4.0.0-33.3.hum1 |
| Red Hat hummingbird 1 | ruby4.0-libs | 0:4.0.0-33.3.hum1 |
| Red Hat rhel software collections 1 | ruby193-ruby | 0:1.9.3.484-50.el7 |
| Red Hat rhel software collections 1 | ruby193-ruby | 0:1.9.3.484-50.el6 |
| Red Hat rhel software collections 1 | ruby193-ruby-debuginfo | 0:1.9.3.484-50.el7 |
| Red Hat rhel software collections 1 | ruby193-ruby-debuginfo | 0:1.9.3.484-50.el6 |
| Red Hat rhel software collections 1 | ruby193-ruby-devel | 0:1.9.3.484-50.el7 |
| Red Hat rhel software collections 1 | ruby193-ruby-devel | 0:1.9.3.484-50.el6 |
| Red Hat rhel software collections 1 | ruby193-ruby-doc | 0:1.9.3.484-50.el7 |
| Red Hat rhel software collections 1 | ruby193-ruby-doc | 0:1.9.3.484-50.el6 |
| Red Hat rhel software collections 1 | ruby193-ruby-irb | 0:1.9.3.484-50.el6 |
| Red Hat rhel software collections 1 | ruby193-ruby-irb | 0:1.9.3.484-50.el7 |
| Red Hat rhel software collections 1 | ruby193-ruby-libs | 0:1.9.3.484-50.el7 |
| Red Hat rhel software collections 1 | ruby193-ruby-libs | 0:1.9.3.484-50.el6 |
| Red Hat rhel software collections 1 | ruby193-ruby-tcltk | 0:1.9.3.484-50.el6 |
| Red Hat rhel software collections 1 | ruby193-ruby-tcltk | 0:1.9.3.484-50.el7 |
| Red Hat rhel software collections 1 | ruby193-rubygem-bigdecimal | 0:1.1.0-50.el7 |
| Red Hat rhel software collections 1 | ruby193-rubygem-bigdecimal | 0:1.1.0-50.el6 |
| Red Hat rhel software collections 1 | ruby193-rubygem-io-console | 0:0.3-50.el6 |
| Red Hat rhel software collections 1 | ruby193-rubygem-io-console | 0:0.3-50.el7 |
| Red Hat rhel software collections 1 | ruby193-rubygem-json | 0:1.5.5-50.el6 |
| Red Hat rhel software collections 1 | ruby193-rubygem-json | 0:1.5.5-50.el7 |
| Red Hat rhel software collections 1 | ruby193-rubygem-minitest | 0:2.5.1-50.el7 |
| Red Hat rhel software collections 1 | ruby193-rubygem-minitest | 0:2.5.1-50.el6 |
| Red Hat rhel software collections 1 | ruby193-rubygem-rake | 0:0.9.2.2-50.el7 |
| Red Hat rhel software collections 1 | ruby193-rubygem-rake | 0:0.9.2.2-50.el6 |
| Red Hat rhel software collections 1 | ruby193-rubygem-rdoc | 0:3.9.5-50.el7 |
| Red Hat rhel software collections 1 | ruby193-rubygem-rdoc | 0:3.9.5-50.el6 |
| Red Hat rhel software collections 1 | ruby193-rubygems | 0:1.8.23-50.el6 |
| Red Hat rhel software collections 1 | ruby193-rubygems | 0:1.8.23-50.el7 |
| Red Hat rhel software collections 1 | ruby193-rubygems-devel | 0:1.8.23-50.el7 |
| Red Hat rhel software collections 1 | ruby193-rubygems-devel | 0:1.8.23-50.el6 |
| Red Hat rhel software collections 1 | ruby200-ruby | 0:2.0.0.353-24.el7 |
| Red Hat rhel software collections 1 | ruby200-ruby | 0:2.0.0.353-24.el6 |
| Red Hat rhel software collections 1 | ruby200-ruby-debuginfo | 0:2.0.0.353-24.el7 |
| Red Hat rhel software collections 1 | ruby200-ruby-debuginfo | 0:2.0.0.353-24.el6 |
| Red Hat rhel software collections 1 | ruby200-ruby-devel | 0:2.0.0.353-24.el7 |
| Red Hat rhel software collections 1 | ruby200-ruby-devel | 0:2.0.0.353-24.el6 |
| Red Hat rhel software collections 1 | ruby200-ruby-doc | 0:2.0.0.353-24.el7 |
| Red Hat rhel software collections 1 | ruby200-ruby-doc | 0:2.0.0.353-24.el6 |
| Red Hat rhel software collections 1 | ruby200-ruby-irb | 0:2.0.0.353-24.el7 |
| Red Hat rhel software collections 1 | ruby200-ruby-irb | 0:2.0.0.353-24.el6 |
| Red Hat rhel software collections 1 | ruby200-ruby-libs | 0:2.0.0.353-24.el7 |
| Red Hat rhel software collections 1 | ruby200-ruby-libs | 0:2.0.0.353-24.el6 |
| Red Hat rhel software collections 1 | ruby200-ruby-tcltk | 0:2.0.0.353-24.el7 |
| Red Hat rhel software collections 1 | ruby200-ruby-tcltk | 0:2.0.0.353-24.el6 |
| Red Hat rhel software collections 1 | ruby200-rubygem-bigdecimal | 0:1.2.0-24.el6 |
| Red Hat rhel software collections 1 | ruby200-rubygem-bigdecimal | 0:1.2.0-24.el7 |
| Red Hat rhel software collections 1 | ruby200-rubygem-io-console | 0:0.4.2-24.el6 |
| Red Hat rhel software collections 1 | ruby200-rubygem-io-console | 0:0.4.2-24.el7 |
| Red Hat rhel software collections 1 | ruby200-rubygem-json | 0:1.7.7-24.el6 |
| Red Hat rhel software collections 1 | ruby200-rubygem-json | 0:1.7.7-24.el7 |
| Red Hat rhel software collections 1 | ruby200-rubygem-minitest | 0:4.3.2-24.el6 |
| Red Hat rhel software collections 1 | ruby200-rubygem-minitest | 0:4.3.2-24.el7 |
| Red Hat rhel software collections 1 | ruby200-rubygem-psych | 0:2.0.0-24.el7 |
| Red Hat rhel software collections 1 | ruby200-rubygem-psych | 0:2.0.0-24.el6 |
| Red Hat rhel software collections 1 | ruby200-rubygem-rake | 0:0.9.6-24.el7 |
| Red Hat rhel software collections 1 | ruby200-rubygem-rake | 0:0.9.6-24.el6 |
| Red Hat rhel software collections 1 | ruby200-rubygem-rdoc | 0:4.0.0-24.el7 |
| Red Hat rhel software collections 1 | ruby200-rubygem-rdoc | 0:4.0.0-24.el6 |
| Red Hat rhel software collections 1 | ruby200-rubygems | 0:2.0.14-24.el6 |
| Red Hat rhel software collections 1 | ruby200-rubygems | 0:2.0.14-24.el7 |
| Red Hat rhel software collections 1 | ruby200-rubygems-devel | 0:2.0.14-24.el6 |
| Red Hat rhel software collections 1 | ruby200-rubygems-devel | 0:2.0.14-24.el7 |
| Ubuntu 14.04 LTS | ruby1.9.1 | 1.9.3.484-2ubuntu1.2 |
| Ubuntu 14.04 LTS | ruby2.0 | 2.0.0.484-1ubuntu2.2 |