An unrestricted entity expansion flaw was reported in Ruby that can lead to a denial of service in REXML. When reading text nodes from an XML document, the REXML parser could be coerced into allocating extremely large string objects which could consume all available memory on the system. Impacted code would look similar to the following: document = REXML::Document.new some_xml_doc document.root.text In this case, when the 'text' method is called, entities will be expanded. An attacker could send a relatively small XML document that, when the entities were resolved, would consume extremely large amounts of memory on the target system. It is noted that this vulnerability is similar to the 'Billion Laughs' attack, and is also related to CVE-2013-1664 (Python). The upstream advisory has a work-around patch that limits the size of entity substitutions. External References: http://www.ruby-lang.org/en/news/2013/02/22/rexml-dos-2013-02-22/
This is fixed upstream in version 1.9.3p392 and svn r39384: http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=39384
Created ruby tracking bugs for this issue Affects: fedora-all [bug 914726]
This has been assigned CVE-2013-1821. http://www.openwall.com/lists/oss-security/2013/03/06/5
This issue has been addressed in following products: Red Hat Enterprise Linux 6 Via RHSA-2013:0612 https://rhn.redhat.com/errata/RHSA-2013-0612.html
This issue has been addressed in following products: Red Hat Enterprise Linux 5 Via RHSA-2013:0611 https://rhn.redhat.com/errata/RHSA-2013-0611.html
This issue has been addressed in following products: Fuse ESB Enterprise 7.1.0 Via RHSA-2013:1028 https://rhn.redhat.com/errata/RHSA-2013-1028.html
This issue has been addressed in following products: Red Hat JBoss SOA Platform 5.3.1 Via RHSA-2013:1147 https://rhn.redhat.com/errata/RHSA-2013-1147.html
This issue has been addressed in following products: Red Hat JBoss Fuse 6.0.0 Via RHSA-2013:1185 https://rhn.redhat.com/errata/RHSA-2013-1185.html