Bug 1157709 (CVE-2014-8080) - CVE-2014-8080 ruby: REXML billion laughs attack via parameter entity expansion
Summary: CVE-2014-8080 ruby: REXML billion laughs attack via parameter entity expansion
Keywords:
Status: NEW
Alias: CVE-2014-8080
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1157936 1158215 1163993 1163994 1163998 1164000 1164004 1164005 1165380 1542172 1542173
Blocks: 1157711
TreeView+ depends on / blocked
 
Reported: 2014-10-27 14:30 UTC by Vasyl Kaigorodov
Modified: 2020-08-03 11:39 UTC (History)
54 users (show)

Fixed In Version: ruby 1.9.3-p550, ruby 2.0.0-p594, ruby 2.1.4, jruby 1.7.16.1
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed:


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2014:1911 normal SHIPPED_LIVE Moderate: ruby security update 2014-11-26 21:09:06 UTC
Red Hat Product Errata RHSA-2014:1912 normal SHIPPED_LIVE Moderate: ruby security update 2014-11-27 03:37:35 UTC
Red Hat Product Errata RHSA-2014:1913 normal SHIPPED_LIVE Moderate: ruby193-ruby security update 2014-11-26 21:52:42 UTC
Red Hat Product Errata RHSA-2014:1914 normal SHIPPED_LIVE Moderate: ruby200-ruby security update 2014-11-26 21:52:27 UTC

Description Vasyl Kaigorodov 2014-10-27 14:30:35 UTC
Upstream released new version of Ruby [1] which fixes DoS during XML expansion.
Upstream commit fixing this: http://svn.ruby-lang.org/cgi-bin/viewvc.cgi/?pathrev=48161

[1]: https://www.ruby-lang.org/en/news/2014/10/27/rexml-dos-cve-2014-8080/

Comment 1 Murray McAllister 2014-10-28 04:41:02 UTC
Created ruby tracking bugs for this issue:

Affects: fedora-all [bug 1157936]

Comment 2 Tomas Hoger 2014-10-28 20:24:49 UTC
(In reply to Vasyl Kaigorodov from comment #0)
> Upstream commit fixing this:
> http://svn.ruby-lang.org/cgi-bin/viewvc.cgi/?pathrev=48161

The actual commit is:

http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=48161

It also provides more details of the issue, which were excluded form the upstream advisory.  This issue is a "billion laughs" issue, using parameter entities to trigger high CPU / memory usage DoS.

REXML was previously changed to implement protections against billion laughs attacks, e.g. via bug 460134 (CVE-2008-3790) or via bug 914716 (CVE-2013-1821).

Comment 3 Tomas Hoger 2014-10-28 20:31:13 UTC
External References:

https://www.ruby-lang.org/en/news/2014/10/27/rexml-dos-cve-2014-8080/

Comment 5 Tomas Hoger 2014-10-28 20:32:20 UTC
Created jruby tracking bugs for this issue:

Affects: fedora-all [bug 1158215]

Comment 6 Tomas Hoger 2014-10-28 20:59:24 UTC
JRuby was fixed upstream in version 1.7.16.1:

http://jruby.org/2014/10/28/jruby-1-7-16-1.html

Comment 7 Pavel Polischouk 2014-10-29 02:03:35 UTC
Statement:

Red Hat Enterprise Linux 5 is now in Production 3 Phase of the support and maintenance life cycle. This has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/

Red Hat JBoss SOA Platform 5 is now in Maintenance Support phase receiving only qualified Important and Critical impact security fixes; and Red Hat JBoss SOA Platform 4.3 is now in Extended Life Support phase receiving only Critical impact security fixes. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware Product Life Cycle: https://access.redhat.com/support/policy/updates/jboss_notes/

Comment 8 Tomas Hoger 2014-10-29 09:59:50 UTC
In the past updates, billion laughs attack issues in REXML were addressed by introduction of the REXML::Document.entity_expansion_limit and REXML.entity_expansion_text_limit.  These define limits on the number of entity expansions, or the size of expansion.  These limits were not properly applied when expanding parameter entities, leading to this issue.

Comment 11 Fedora Update System 2014-11-10 06:32:16 UTC
ruby-2.1.4-24.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 17 errata-xmlrpc 2014-11-26 16:09:29 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2014:1911 https://rhn.redhat.com/errata/RHSA-2014-1911.html

Comment 18 errata-xmlrpc 2014-11-26 16:53:01 UTC
This issue has been addressed in the following products:

  Red Hat Software Collections 1 for Red Hat Enterprise Linux 7
  Red Hat Software Collections 1 for Red Hat Enterprise Linux 6
  Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.5 EUS
  Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.4 EUS
  Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.6 EUS

Via RHSA-2014:1914 https://rhn.redhat.com/errata/RHSA-2014-1914.html

Comment 19 errata-xmlrpc 2014-11-26 16:53:29 UTC
This issue has been addressed in the following products:

  Red Hat Software Collections 1 for Red Hat Enterprise Linux 7
  Red Hat Software Collections 1 for Red Hat Enterprise Linux 6
  Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.5 EUS
  Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.4 EUS
  Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.6 EUS

Via RHSA-2014:1913 https://rhn.redhat.com/errata/RHSA-2014-1913.html

Comment 20 errata-xmlrpc 2014-11-26 22:37:54 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2014:1912 https://rhn.redhat.com/errata/RHSA-2014-1912.html


Note You need to log in before you can comment on or make changes to this bug.