Bug 914716 (CVE-2013-1821) - CVE-2013-1821 ruby: entity expansion DoS vulnerability in REXML
Summary: CVE-2013-1821 ruby: entity expansion DoS vulnerability in REXML
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2013-1821
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 914726 915377 915378 915379 915380 948673 948674 974094 978174
Blocks: 914727 958335 978151 980652 981152
TreeView+ depends on / blocked
 
Reported: 2013-02-22 15:46 UTC by Vincent Danen
Modified: 2019-09-29 13:01 UTC (History)
32 users (show)

Fixed In Version: ruby 1.9.3-p392, ruby 2.0.0-p0
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2013-09-03 04:52:57 UTC


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2013:0611 normal SHIPPED_LIVE Moderate: ruby security update 2013-03-07 23:56:11 UTC
Red Hat Product Errata RHSA-2013:0612 normal SHIPPED_LIVE Moderate: ruby security update 2013-03-07 23:53:21 UTC
Red Hat Product Errata RHSA-2013:1028 normal SHIPPED_LIVE Important: Fuse ESB Enterprise 7.1.0 update 2013-07-09 21:36:00 UTC
Red Hat Product Errata RHSA-2013:1147 normal SHIPPED_LIVE Moderate: Red Hat JBoss SOA Platform 5.3.1 update 2013-08-08 21:07:08 UTC
Red Hat Product Errata RHSA-2013:1185 normal SHIPPED_LIVE Important: Red Hat JBoss Fuse 6.0.0 patch 2 2013-08-30 03:27:44 UTC

Description Vincent Danen 2013-02-22 15:46:31 UTC
An unrestricted entity expansion flaw was reported in Ruby that can lead to a denial of service in REXML.  When reading text nodes from an XML document, the REXML parser could be coerced into allocating extremely large string objects which could consume all available memory on the system.

Impacted code would look similar to the following:

document = REXML::Document.new some_xml_doc
document.root.text

In this case, when the 'text' method is called, entities will be expanded.  An attacker could send a relatively small XML document that, when the entities were resolved, would consume extremely large amounts of memory on the target system.  It is noted that this vulnerability is similar to the 'Billion Laughs' attack, and is also related to CVE-2013-1664 (Python).

The upstream advisory has a work-around patch that limits the size of entity substitutions.


External References:

http://www.ruby-lang.org/en/news/2013/02/22/rexml-dos-2013-02-22/

Comment 1 Vincent Danen 2013-02-22 16:03:22 UTC
This is fixed upstream in version 1.9.3p392 and svn r39384:

http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=39384

Comment 2 Vincent Danen 2013-02-22 16:06:45 UTC
Created ruby tracking bugs for this issue

Affects: fedora-all [bug 914726]

Comment 6 Stefan Cornelius 2013-03-06 18:43:45 UTC
This has been assigned CVE-2013-1821.
http://www.openwall.com/lists/oss-security/2013/03/06/5

Comment 7 errata-xmlrpc 2013-03-07 18:59:03 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2013:0612 https://rhn.redhat.com/errata/RHSA-2013-0612.html

Comment 8 errata-xmlrpc 2013-03-07 18:59:45 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2013:0611 https://rhn.redhat.com/errata/RHSA-2013-0611.html

Comment 13 errata-xmlrpc 2013-07-09 17:37:35 UTC
This issue has been addressed in following products:

  Fuse ESB Enterprise 7.1.0

Via RHSA-2013:1028 https://rhn.redhat.com/errata/RHSA-2013-1028.html

Comment 14 errata-xmlrpc 2013-08-08 17:09:12 UTC
This issue has been addressed in following products:

  Red Hat JBoss SOA Platform 5.3.1

Via RHSA-2013:1147 https://rhn.redhat.com/errata/RHSA-2013-1147.html

Comment 15 errata-xmlrpc 2013-08-29 23:29:00 UTC
This issue has been addressed in following products:

  Red Hat JBoss Fuse 6.0.0

Via RHSA-2013:1185 https://rhn.redhat.com/errata/RHSA-2013-1185.html


Note You need to log in before you can comment on or make changes to this bug.