Fluid Attacks Database

Description

The REXML parser in Ruby 1.9.x before 1.9.3-p550, 2.0.x before 2.0.0-p594, and 2.1.x before 2.1.4 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document, aka an XML Entity Expansion (XEE) attack.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
rpm rhel7	ruby	<0:2.0.0.353-22.el7_0	0:2.0.0.353-22.el7_0
rpm rhel5	ruby	-	-
rpm rhel6	ruby	<0:1.8.7.374-3.el6_6	0:1.8.7.374-3.el6_6

Aliases

1. CVE-2014-80802. NVD-2014-80803. OSV-2014-8080

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.