1. CVE-Search
  2. CVE-2014-8090
ID CVE-2014-8090
Summary The REXML parser in Ruby 1.9.x before 1.9.3 patchlevel 551, 2.0.x before 2.0.0 patchlevel 598, and 2.1.x before 2.1.5 allows remote attackers to cause a denial of service (CPU and memory consumption) a crafted XML document containing an empty string in an entity that is used in a large number of nested entity references, aka an XML Entity Expansion (XEE) attack. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-1821 and CVE-2014-8080. <a href="http://cwe.mitre.org/data/definitions/611.html" target="_blank">CWE-611: Improper Restriction of XML External Entity Reference ('XXE')</a>
References
Vulnerable Configurations
  • cpe:2.3:a:ruby-lang:ruby:1.9.3:*:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:1.9.3:*:*:*:*:*:*:*
  • cpe:2.3:a:ruby-lang:ruby:1.9.3:p0:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:1.9.3:p0:*:*:*:*:*:*
  • cpe:2.3:a:ruby-lang:ruby:1.9.3:p125:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:1.9.3:p125:*:*:*:*:*:*
  • cpe:2.3:a:ruby-lang:ruby:1.9.3:p194:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:1.9.3:p194:*:*:*:*:*:*
  • cpe:2.3:a:ruby-lang:ruby:1.9.3:p286:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:1.9.3:p286:*:*:*:*:*:*
  • cpe:2.3:a:ruby-lang:ruby:1.9.3:p383:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:1.9.3:p383:*:*:*:*:*:*
  • cpe:2.3:a:ruby-lang:ruby:1.9.3:p385:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:1.9.3:p385:*:*:*:*:*:*
  • cpe:2.3:a:ruby-lang:ruby:1.9.3:p392:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:1.9.3:p392:*:*:*:*:*:*
  • cpe:2.3:a:ruby-lang:ruby:1.9.3:p426:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:1.9.3:p426:*:*:*:*:*:*
  • cpe:2.3:a:ruby-lang:ruby:1.9.3:p429:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:1.9.3:p429:*:*:*:*:*:*
  • cpe:2.3:a:ruby-lang:ruby:1.9.3:p448:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:1.9.3:p448:*:*:*:*:*:*
  • cpe:2.3:a:ruby-lang:ruby:1.9.3:p545:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:1.9.3:p545:*:*:*:*:*:*
  • cpe:2.3:a:ruby-lang:ruby:1.9.3:p547:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:1.9.3:p547:*:*:*:*:*:*
  • cpe:2.3:a:ruby-lang:ruby:*:p550:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:*:p550:*:*:*:*:*:*
  • cpe:2.3:a:ruby-lang:ruby:2.0.0:*:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:2.0.0:*:*:*:*:*:*:*
  • cpe:2.3:a:ruby-lang:ruby:2.0.0:p0:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:2.0.0:p0:*:*:*:*:*:*
  • cpe:2.3:a:ruby-lang:ruby:2.0.0:p195:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:2.0.0:p195:*:*:*:*:*:*
  • cpe:2.3:a:ruby-lang:ruby:2.0.0:p247:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:2.0.0:p247:*:*:*:*:*:*
  • cpe:2.3:a:ruby-lang:ruby:2.0.0:p451:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:2.0.0:p451:*:*:*:*:*:*
  • cpe:2.3:a:ruby-lang:ruby:2.0.0:p481:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:2.0.0:p481:*:*:*:*:*:*
  • cpe:2.3:a:ruby-lang:ruby:2.0.0:p576:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:2.0.0:p576:*:*:*:*:*:*
  • cpe:2.3:a:ruby-lang:ruby:2.0.0:p594:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:2.0.0:p594:*:*:*:*:*:*
  • cpe:2.3:a:ruby-lang:ruby:2.1.1:*:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:2.1.1:*:*:*:*:*:*:*
  • cpe:2.3:a:ruby-lang:ruby:2.1.2:*:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:2.1.2:*:*:*:*:*:*:*
  • cpe:2.3:a:ruby-lang:ruby:2.1.3:*:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:2.1.3:*:*:*:*:*:*:*
  • cpe:2.3:a:ruby-lang:ruby:2.1.4:*:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:2.1.4:*:*:*:*:*:*:*
CVSS
Base: 5.0 (as of 03-01-2017 - 02:59)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
NONE NONE PARTIAL
cvss-vector via4 AV:N/AC:L/Au:N/C:N/I:N/A:P
redhat via4
advisories
  • bugzilla
    id 1159927
    title CVE-2014-8090 ruby: REXML incomplete fix for CVE-2014-8080
    oval
    OR
    • comment Red Hat Enterprise Linux must be installed
      oval oval:com.redhat.rhba:tst:20070304026
    • AND
      • comment Red Hat Enterprise Linux 6 is installed
        oval oval:com.redhat.rhba:tst:20111656003
      • OR
        • AND
          • comment ruby is earlier than 0:1.8.7.374-3.el6_6
            oval oval:com.redhat.rhsa:tst:20141911001
          • comment ruby is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhba:tst:20193384002
        • AND
          • comment ruby-devel is earlier than 0:1.8.7.374-3.el6_6
            oval oval:com.redhat.rhsa:tst:20141911003
          • comment ruby-devel is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhba:tst:20193384006
        • AND
          • comment ruby-docs is earlier than 0:1.8.7.374-3.el6_6
            oval oval:com.redhat.rhsa:tst:20141911005
          • comment ruby-docs is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20110910006
        • AND
          • comment ruby-irb is earlier than 0:1.8.7.374-3.el6_6
            oval oval:com.redhat.rhsa:tst:20141911007
          • comment ruby-irb is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhba:tst:20193384010
        • AND
          • comment ruby-libs is earlier than 0:1.8.7.374-3.el6_6
            oval oval:com.redhat.rhsa:tst:20141911009
          • comment ruby-libs is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhba:tst:20193384012
        • AND
          • comment ruby-rdoc is earlier than 0:1.8.7.374-3.el6_6
            oval oval:com.redhat.rhsa:tst:20141911011
          • comment ruby-rdoc is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20110910012
        • AND
          • comment ruby-ri is earlier than 0:1.8.7.374-3.el6_6
            oval oval:com.redhat.rhsa:tst:20141911013
          • comment ruby-ri is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20110910014
        • AND
          • comment ruby-static is earlier than 0:1.8.7.374-3.el6_6
            oval oval:com.redhat.rhsa:tst:20141911015
          • comment ruby-static is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20110910016
        • AND
          • comment ruby-tcltk is earlier than 0:1.8.7.374-3.el6_6
            oval oval:com.redhat.rhsa:tst:20141911017
          • comment ruby-tcltk is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20110910018
    rhsa
    id RHSA-2014:1911
    released 2014-11-26
    severity Moderate
    title RHSA-2014:1911: ruby security update (Moderate)
  • bugzilla
    id 1159927
    title CVE-2014-8090 ruby: REXML incomplete fix for CVE-2014-8080
    oval
    OR
    • comment Red Hat Enterprise Linux must be installed
      oval oval:com.redhat.rhba:tst:20070304026
    • AND
      • comment Red Hat Enterprise Linux 7 is installed
        oval oval:com.redhat.rhba:tst:20150364027
      • OR
        • AND
          • comment ruby is earlier than 0:2.0.0.353-22.el7_0
            oval oval:com.redhat.rhsa:tst:20141912001
          • comment ruby is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhba:tst:20193384002
        • AND
          • comment ruby-devel is earlier than 0:2.0.0.353-22.el7_0
            oval oval:com.redhat.rhsa:tst:20141912003
          • comment ruby-devel is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhba:tst:20193384006
        • AND
          • comment ruby-doc is earlier than 0:2.0.0.353-22.el7_0
            oval oval:com.redhat.rhsa:tst:20141912005
          • comment ruby-doc is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhba:tst:20193384008
        • AND
          • comment ruby-irb is earlier than 0:2.0.0.353-22.el7_0
            oval oval:com.redhat.rhsa:tst:20141912007
          • comment ruby-irb is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhba:tst:20193384010
        • AND
          • comment ruby-libs is earlier than 0:2.0.0.353-22.el7_0
            oval oval:com.redhat.rhsa:tst:20141912009
          • comment ruby-libs is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhba:tst:20193384012
        • AND
          • comment ruby-tcltk is earlier than 0:2.0.0.353-22.el7_0
            oval oval:com.redhat.rhsa:tst:20141912011
          • comment ruby-tcltk is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20110910018
        • AND
          • comment rubygem-bigdecimal is earlier than 0:1.2.0-22.el7_0
            oval oval:com.redhat.rhsa:tst:20141912013
          • comment rubygem-bigdecimal is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhba:tst:20193384018
        • AND
          • comment rubygem-io-console is earlier than 0:0.4.2-22.el7_0
            oval oval:com.redhat.rhsa:tst:20141912015
          • comment rubygem-io-console is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhba:tst:20193384032
        • AND
          • comment rubygem-json is earlier than 0:1.7.7-22.el7_0
            oval oval:com.redhat.rhsa:tst:20141912017
          • comment rubygem-json is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhba:tst:20193384034
        • AND
          • comment rubygem-minitest is earlier than 0:4.3.2-22.el7_0
            oval oval:com.redhat.rhsa:tst:20141912019
          • comment rubygem-minitest is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhba:tst:20193384036
        • AND
          • comment rubygem-psych is earlier than 0:2.0.0-22.el7_0
            oval oval:com.redhat.rhsa:tst:20141912021
          • comment rubygem-psych is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhba:tst:20193384060
        • AND
          • comment rubygem-rake is earlier than 0:0.9.6-22.el7_0
            oval oval:com.redhat.rhsa:tst:20141912023
          • comment rubygem-rake is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhba:tst:20193384062
        • AND
          • comment rubygem-rdoc is earlier than 0:4.0.0-22.el7_0
            oval oval:com.redhat.rhsa:tst:20141912025
          • comment rubygem-rdoc is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhba:tst:20193384064
        • AND
          • comment rubygems is earlier than 0:2.0.14-22.el7_0
            oval oval:com.redhat.rhsa:tst:20141912027
          • comment rubygems is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhba:tst:20193384070
        • AND
          • comment rubygems-devel is earlier than 0:2.0.14-22.el7_0
            oval oval:com.redhat.rhsa:tst:20141912029
          • comment rubygems-devel is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhba:tst:20193384072
    rhsa
    id RHSA-2014:1912
    released 2014-11-26
    severity Moderate
    title RHSA-2014:1912: ruby security update (Moderate)
  • rhsa
    id RHSA-2014:1913
  • rhsa
    id RHSA-2014:1914
rpms
  • ruby-0:1.8.7.374-3.el6_6
  • ruby-debuginfo-0:1.8.7.374-3.el6_6
  • ruby-devel-0:1.8.7.374-3.el6_6
  • ruby-docs-0:1.8.7.374-3.el6_6
  • ruby-irb-0:1.8.7.374-3.el6_6
  • ruby-libs-0:1.8.7.374-3.el6_6
  • ruby-rdoc-0:1.8.7.374-3.el6_6
  • ruby-ri-0:1.8.7.374-3.el6_6
  • ruby-static-0:1.8.7.374-3.el6_6
  • ruby-tcltk-0:1.8.7.374-3.el6_6
  • ruby-0:2.0.0.353-22.el7_0
  • ruby-debuginfo-0:2.0.0.353-22.el7_0
  • ruby-devel-0:2.0.0.353-22.el7_0
  • ruby-doc-0:2.0.0.353-22.el7_0
  • ruby-irb-0:2.0.0.353-22.el7_0
  • ruby-libs-0:2.0.0.353-22.el7_0
  • ruby-tcltk-0:2.0.0.353-22.el7_0
  • rubygem-bigdecimal-0:1.2.0-22.el7_0
  • rubygem-io-console-0:0.4.2-22.el7_0
  • rubygem-json-0:1.7.7-22.el7_0
  • rubygem-minitest-0:4.3.2-22.el7_0
  • rubygem-psych-0:2.0.0-22.el7_0
  • rubygem-rake-0:0.9.6-22.el7_0
  • rubygem-rdoc-0:4.0.0-22.el7_0
  • rubygems-0:2.0.14-22.el7_0
  • rubygems-devel-0:2.0.14-22.el7_0
  • ruby193-ruby-0:1.9.3.484-50.el6
  • ruby193-ruby-0:1.9.3.484-50.el7
  • ruby193-ruby-debuginfo-0:1.9.3.484-50.el6
  • ruby193-ruby-debuginfo-0:1.9.3.484-50.el7
  • ruby193-ruby-devel-0:1.9.3.484-50.el6
  • ruby193-ruby-devel-0:1.9.3.484-50.el7
  • ruby193-ruby-doc-0:1.9.3.484-50.el6
  • ruby193-ruby-doc-0:1.9.3.484-50.el7
  • ruby193-ruby-irb-0:1.9.3.484-50.el6
  • ruby193-ruby-irb-0:1.9.3.484-50.el7
  • ruby193-ruby-libs-0:1.9.3.484-50.el6
  • ruby193-ruby-libs-0:1.9.3.484-50.el7
  • ruby193-ruby-tcltk-0:1.9.3.484-50.el6
  • ruby193-ruby-tcltk-0:1.9.3.484-50.el7
  • ruby193-rubygem-bigdecimal-0:1.1.0-50.el6
  • ruby193-rubygem-bigdecimal-0:1.1.0-50.el7
  • ruby193-rubygem-io-console-0:0.3-50.el6
  • ruby193-rubygem-io-console-0:0.3-50.el7
  • ruby193-rubygem-json-0:1.5.5-50.el6
  • ruby193-rubygem-json-0:1.5.5-50.el7
  • ruby193-rubygem-minitest-0:2.5.1-50.el6
  • ruby193-rubygem-minitest-0:2.5.1-50.el7
  • ruby193-rubygem-rake-0:0.9.2.2-50.el6
  • ruby193-rubygem-rake-0:0.9.2.2-50.el7
  • ruby193-rubygem-rdoc-0:3.9.5-50.el6
  • ruby193-rubygem-rdoc-0:3.9.5-50.el7
  • ruby193-rubygems-0:1.8.23-50.el6
  • ruby193-rubygems-0:1.8.23-50.el7
  • ruby193-rubygems-devel-0:1.8.23-50.el6
  • ruby193-rubygems-devel-0:1.8.23-50.el7
  • ruby200-ruby-0:2.0.0.353-24.el6
  • ruby200-ruby-0:2.0.0.353-24.el7
  • ruby200-ruby-debuginfo-0:2.0.0.353-24.el6
  • ruby200-ruby-debuginfo-0:2.0.0.353-24.el7
  • ruby200-ruby-devel-0:2.0.0.353-24.el6
  • ruby200-ruby-devel-0:2.0.0.353-24.el7
  • ruby200-ruby-doc-0:2.0.0.353-24.el6
  • ruby200-ruby-doc-0:2.0.0.353-24.el7
  • ruby200-ruby-irb-0:2.0.0.353-24.el6
  • ruby200-ruby-irb-0:2.0.0.353-24.el7
  • ruby200-ruby-libs-0:2.0.0.353-24.el6
  • ruby200-ruby-libs-0:2.0.0.353-24.el7
  • ruby200-ruby-tcltk-0:2.0.0.353-24.el6
  • ruby200-ruby-tcltk-0:2.0.0.353-24.el7
  • ruby200-rubygem-bigdecimal-0:1.2.0-24.el6
  • ruby200-rubygem-bigdecimal-0:1.2.0-24.el7
  • ruby200-rubygem-io-console-0:0.4.2-24.el6
  • ruby200-rubygem-io-console-0:0.4.2-24.el7
  • ruby200-rubygem-json-0:1.7.7-24.el6
  • ruby200-rubygem-json-0:1.7.7-24.el7
  • ruby200-rubygem-minitest-0:4.3.2-24.el6
  • ruby200-rubygem-minitest-0:4.3.2-24.el7
  • ruby200-rubygem-psych-0:2.0.0-24.el6
  • ruby200-rubygem-psych-0:2.0.0-24.el7
  • ruby200-rubygem-rake-0:0.9.6-24.el6
  • ruby200-rubygem-rake-0:0.9.6-24.el7
  • ruby200-rubygem-rdoc-0:4.0.0-24.el6
  • ruby200-rubygem-rdoc-0:4.0.0-24.el7
  • ruby200-rubygems-0:2.0.14-24.el6
  • ruby200-rubygems-0:2.0.14-24.el7
  • ruby200-rubygems-devel-0:2.0.14-24.el6
  • ruby200-rubygems-devel-0:2.0.14-24.el7
refmap via4
apple APPLE-SA-2015-09-30-3
bid 71230
confirm
debian
  • DSA-3157
  • DSA-3159
mandriva MDVSA-2015:129
secunia
  • 59948
  • 62050
  • 62748
suse
  • openSUSE-SU-2014:1589
  • openSUSE-SU-2015:0002
  • openSUSE-SU-2015:0007
ubuntu USN-2412-1
Last major update 03-01-2017 - 02:59
Published 21-11-2014 - 15:59
Last modified 03-01-2017 - 02:59
Back to Top