[arch-security] [Arch Linux Security Advisory ASA-201411-16] ruby: denial of service
anthraxx at archlinux.org
Mon Nov 17 16:47:56 UTC 2014
Arch Linux Security Advisory ASA-201411-16
Date : 2014-11-17
CVE-ID : CVE-2014-8090
Package : ruby
Type : denial of service
Remote : Yes
Link : https://wiki.archlinux.org/index.php/CVE-2014
The package ruby before version 2.1.5-1 is vulnerable to denial service
through unrestricted XML entity expansion.
Upgrade to 2.1.5-1.
# pacman -Syu "ruby>=2.1.5-1"
The problem has been fixed upstream in version 2.1.5.
If you cannot upgrade Ruby, use this monkey patch as a workaround:
CPU exhaustion can occur as a result of recursive expansion with an
empty string. When reading text nodes from an XML document, the REXML
parser can be coerced into allocating extremely large string objects
which can consume all of the memory on a machine, causing a denial of
A remote attacker using an specially crafted XML document is able to
perform denial of service through CPU and/or memory exhaustion.
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 819 bytes
Desc: OpenPGP digital signature
More information about the arch-security