ID CVE-2014-8090
Summary The REXML parser in Ruby 1.9.x before 1.9.3 patchlevel 551, 2.0.x before 2.0.0 patchlevel 598, and 2.1.x before 2.1.5 allows remote attackers to cause a denial of service (CPU and memory consumption) a crafted XML document containing an empty string in an entity that is used in a large number of nested entity references, aka an XML Entity Expansion (XEE) attack. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-1821 and CVE-2014-8080. <a href="http://cwe.mitre.org/data/definitions/611.html" target="_blank">CWE-611: Improper Restriction of XML External Entity Reference ('XXE')</a>
References
Vulnerable Configurations
  • cpe:2.3:a:ruby-lang:ruby:1.9.3:*:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:1.9.3:*:*:*:*:*:*:*
  • cpe:2.3:a:ruby-lang:ruby:1.9.3:p0:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:1.9.3:p0:*:*:*:*:*:*
  • cpe:2.3:a:ruby-lang:ruby:1.9.3:p125:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:1.9.3:p125:*:*:*:*:*:*
  • cpe:2.3:a:ruby-lang:ruby:1.9.3:p194:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:1.9.3:p194:*:*:*:*:*:*
  • cpe:2.3:a:ruby-lang:ruby:1.9.3:p286:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:1.9.3:p286:*:*:*:*:*:*
  • cpe:2.3:a:ruby-lang:ruby:1.9.3:p383:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:1.9.3:p383:*:*:*:*:*:*
  • cpe:2.3:a:ruby-lang:ruby:1.9.3:p385:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:1.9.3:p385:*:*:*:*:*:*
  • cpe:2.3:a:ruby-lang:ruby:1.9.3:p392:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:1.9.3:p392:*:*:*:*:*:*
  • cpe:2.3:a:ruby-lang:ruby:1.9.3:p426:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:1.9.3:p426:*:*:*:*:*:*
  • cpe:2.3:a:ruby-lang:ruby:1.9.3:p429:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:1.9.3:p429:*:*:*:*:*:*
  • cpe:2.3:a:ruby-lang:ruby:1.9.3:p448:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:1.9.3:p448:*:*:*:*:*:*
  • cpe:2.3:a:ruby-lang:ruby:1.9.3:p545:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:1.9.3:p545:*:*:*:*:*:*
  • cpe:2.3:a:ruby-lang:ruby:1.9.3:p547:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:1.9.3:p547:*:*:*:*:*:*
  • cpe:2.3:a:ruby-lang:ruby:*:p550:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:*:p550:*:*:*:*:*:*
  • cpe:2.3:a:ruby-lang:ruby:2.0.0:*:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:2.0.0:*:*:*:*:*:*:*
  • cpe:2.3:a:ruby-lang:ruby:2.0.0:p0:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:2.0.0:p0:*:*:*:*:*:*
  • cpe:2.3:a:ruby-lang:ruby:2.0.0:p195:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:2.0.0:p195:*:*:*:*:*:*
  • cpe:2.3:a:ruby-lang:ruby:2.0.0:p247:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:2.0.0:p247:*:*:*:*:*:*
  • cpe:2.3:a:ruby-lang:ruby:2.0.0:p451:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:2.0.0:p451:*:*:*:*:*:*
  • cpe:2.3:a:ruby-lang:ruby:2.0.0:p481:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:2.0.0:p481:*:*:*:*:*:*
  • cpe:2.3:a:ruby-lang:ruby:2.0.0:p576:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:2.0.0:p576:*:*:*:*:*:*
  • cpe:2.3:a:ruby-lang:ruby:2.0.0:p594:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:2.0.0:p594:*:*:*:*:*:*
  • cpe:2.3:a:ruby-lang:ruby:2.1.1:*:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:2.1.1:*:*:*:*:*:*:*
  • cpe:2.3:a:ruby-lang:ruby:2.1.2:*:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:2.1.2:*:*:*:*:*:*:*
  • cpe:2.3:a:ruby-lang:ruby:2.1.3:*:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:2.1.3:*:*:*:*:*:*:*
  • cpe:2.3:a:ruby-lang:ruby:2.1.4:*:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:2.1.4:*:*:*:*:*:*:*
CVSS
Base: 5.0 (as of 03-01-2017 - 02:59)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
NONE NONE PARTIAL
cvss-vector via4 AV:N/AC:L/Au:N/C:N/I:N/A:P
redhat via4
advisories
  • bugzilla
    id 1159927
    title CVE-2014-8090 ruby: REXML incomplete fix for CVE-2014-8080
    oval
    AND
    • OR
      • comment Red Hat Enterprise Linux 6 Client is installed
        oval oval:com.redhat.rhba:tst:20111656001
      • comment Red Hat Enterprise Linux 6 Server is installed
        oval oval:com.redhat.rhba:tst:20111656002
      • comment Red Hat Enterprise Linux 6 Workstation is installed
        oval oval:com.redhat.rhba:tst:20111656003
      • comment Red Hat Enterprise Linux 6 ComputeNode is installed
        oval oval:com.redhat.rhba:tst:20111656004
    • OR
      • AND
        • comment ruby is earlier than 0:1.8.7.374-3.el6_6
          oval oval:com.redhat.rhsa:tst:20141911005
        • comment ruby is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110910006
      • AND
        • comment ruby-devel is earlier than 0:1.8.7.374-3.el6_6
          oval oval:com.redhat.rhsa:tst:20141911017
        • comment ruby-devel is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110910016
      • AND
        • comment ruby-docs is earlier than 0:1.8.7.374-3.el6_6
          oval oval:com.redhat.rhsa:tst:20141911013
        • comment ruby-docs is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110910012
      • AND
        • comment ruby-irb is earlier than 0:1.8.7.374-3.el6_6
          oval oval:com.redhat.rhsa:tst:20141911019
        • comment ruby-irb is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110910018
      • AND
        • comment ruby-libs is earlier than 0:1.8.7.374-3.el6_6
          oval oval:com.redhat.rhsa:tst:20141911011
        • comment ruby-libs is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110910020
      • AND
        • comment ruby-rdoc is earlier than 0:1.8.7.374-3.el6_6
          oval oval:com.redhat.rhsa:tst:20141911021
        • comment ruby-rdoc is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110910022
      • AND
        • comment ruby-ri is earlier than 0:1.8.7.374-3.el6_6
          oval oval:com.redhat.rhsa:tst:20141911007
        • comment ruby-ri is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110910014
      • AND
        • comment ruby-static is earlier than 0:1.8.7.374-3.el6_6
          oval oval:com.redhat.rhsa:tst:20141911015
        • comment ruby-static is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110910010
      • AND
        • comment ruby-tcltk is earlier than 0:1.8.7.374-3.el6_6
          oval oval:com.redhat.rhsa:tst:20141911009
        • comment ruby-tcltk is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110910008
    rhsa
    id RHSA-2014:1911
    released 2014-11-26
    severity Moderate
    title RHSA-2014:1911: ruby security update (Moderate)
  • bugzilla
    id 1159927
    title CVE-2014-8090 ruby: REXML incomplete fix for CVE-2014-8080
    oval
    AND
    • OR
      • comment Red Hat Enterprise Linux 7 Client is installed
        oval oval:com.redhat.rhba:tst:20150364001
      • comment Red Hat Enterprise Linux 7 Server is installed
        oval oval:com.redhat.rhba:tst:20150364002
      • comment Red Hat Enterprise Linux 7 Workstation is installed
        oval oval:com.redhat.rhba:tst:20150364003
      • comment Red Hat Enterprise Linux 7 ComputeNode is installed
        oval oval:com.redhat.rhba:tst:20150364004
    • OR
      • AND
        • comment ruby is earlier than 0:2.0.0.353-22.el7_0
          oval oval:com.redhat.rhsa:tst:20141912005
        • comment ruby is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110910006
      • AND
        • comment ruby-devel is earlier than 0:2.0.0.353-22.el7_0
          oval oval:com.redhat.rhsa:tst:20141912009
        • comment ruby-devel is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110910016
      • AND
        • comment ruby-doc is earlier than 0:2.0.0.353-22.el7_0
          oval oval:com.redhat.rhsa:tst:20141912027
        • comment ruby-doc is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20141912028
      • AND
        • comment ruby-irb is earlier than 0:2.0.0.353-22.el7_0
          oval oval:com.redhat.rhsa:tst:20141912015
        • comment ruby-irb is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110910018
      • AND
        • comment ruby-libs is earlier than 0:2.0.0.353-22.el7_0
          oval oval:com.redhat.rhsa:tst:20141912007
        • comment ruby-libs is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110910020
      • AND
        • comment ruby-tcltk is earlier than 0:2.0.0.353-22.el7_0
          oval oval:com.redhat.rhsa:tst:20141912029
        • comment ruby-tcltk is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110910008
      • AND
        • comment rubygem-bigdecimal is earlier than 0:1.2.0-22.el7_0
          oval oval:com.redhat.rhsa:tst:20141912019
        • comment rubygem-bigdecimal is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20141912020
      • AND
        • comment rubygem-io-console is earlier than 0:0.4.2-22.el7_0
          oval oval:com.redhat.rhsa:tst:20141912025
        • comment rubygem-io-console is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20141912026
      • AND
        • comment rubygem-json is earlier than 0:1.7.7-22.el7_0
          oval oval:com.redhat.rhsa:tst:20141912011
        • comment rubygem-json is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20141912012
      • AND
        • comment rubygem-minitest is earlier than 0:4.3.2-22.el7_0
          oval oval:com.redhat.rhsa:tst:20141912017
        • comment rubygem-minitest is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20141912018
      • AND
        • comment rubygem-psych is earlier than 0:2.0.0-22.el7_0
          oval oval:com.redhat.rhsa:tst:20141912033
        • comment rubygem-psych is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20141912034
      • AND
        • comment rubygem-rake is earlier than 0:0.9.6-22.el7_0
          oval oval:com.redhat.rhsa:tst:20141912031
        • comment rubygem-rake is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20141912032
      • AND
        • comment rubygem-rdoc is earlier than 0:4.0.0-22.el7_0
          oval oval:com.redhat.rhsa:tst:20141912023
        • comment rubygem-rdoc is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20141912024
      • AND
        • comment rubygems is earlier than 0:2.0.14-22.el7_0
          oval oval:com.redhat.rhsa:tst:20141912021
        • comment rubygems is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20131441006
      • AND
        • comment rubygems-devel is earlier than 0:2.0.14-22.el7_0
          oval oval:com.redhat.rhsa:tst:20141912013
        • comment rubygems-devel is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20141912014
    rhsa
    id RHSA-2014:1912
    released 2014-11-26
    severity Moderate
    title RHSA-2014:1912: ruby security update (Moderate)
  • rhsa
    id RHSA-2014:1913
  • rhsa
    id RHSA-2014:1914
rpms
  • ruby-0:1.8.7.374-3.el6_6
  • ruby-devel-0:1.8.7.374-3.el6_6
  • ruby-docs-0:1.8.7.374-3.el6_6
  • ruby-irb-0:1.8.7.374-3.el6_6
  • ruby-libs-0:1.8.7.374-3.el6_6
  • ruby-rdoc-0:1.8.7.374-3.el6_6
  • ruby-ri-0:1.8.7.374-3.el6_6
  • ruby-static-0:1.8.7.374-3.el6_6
  • ruby-tcltk-0:1.8.7.374-3.el6_6
  • ruby-0:2.0.0.353-22.el7_0
  • ruby-devel-0:2.0.0.353-22.el7_0
  • ruby-doc-0:2.0.0.353-22.el7_0
  • ruby-irb-0:2.0.0.353-22.el7_0
  • ruby-libs-0:2.0.0.353-22.el7_0
  • ruby-tcltk-0:2.0.0.353-22.el7_0
  • rubygem-bigdecimal-0:1.2.0-22.el7_0
  • rubygem-io-console-0:0.4.2-22.el7_0
  • rubygem-json-0:1.7.7-22.el7_0
  • rubygem-minitest-0:4.3.2-22.el7_0
  • rubygem-psych-0:2.0.0-22.el7_0
  • rubygem-rake-0:0.9.6-22.el7_0
  • rubygem-rdoc-0:4.0.0-22.el7_0
  • rubygems-0:2.0.14-22.el7_0
  • rubygems-devel-0:2.0.14-22.el7_0
refmap via4
apple APPLE-SA-2015-09-30-3
bid 71230
confirm
debian
  • DSA-3157
  • DSA-3159
mandriva MDVSA-2015:129
secunia
  • 59948
  • 62050
  • 62748
suse
  • openSUSE-SU-2014:1589
  • openSUSE-SU-2015:0002
  • openSUSE-SU-2015:0007
ubuntu USN-2412-1
Last major update 03-01-2017 - 02:59
Published 21-11-2014 - 15:59
Back to Top