PT-2013-3407 · Ruby+4 · Rexml+5
Publicado
2013-03-07
·
Atualizado
2022-05-17
·
CVE-2013-1821
CVSS v2.0
5.0
Média
| Vetor | AV:N/AC:L/Au:N/C:N/I:N/A:P |
Name of the Vulnerable Software and Affected Versions
REXML parser in Ruby versions prior to 1.9.3-p392
Description
The issue allows remote attackers to cause a denial of service, resulting in memory consumption and crash, via crafted text nodes in an XML document. This is also known as an XML Entity Expansion (XEE) attack. When reading text nodes from an XML document, the REXML parser can be coerced into allocating extremely large string objects, consuming all of the memory on a machine.
Recommendations
For versions prior to 1.9.3-p392, update to version 1.9.3-p392 or later to resolve the issue.
As a temporary workaround, consider restricting the use of the REXML parser until a patch is available.
Correção
DoS
RCE
Resource Exhaustion
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Centos
Rexml
Red Hat
Ruby
Suse