CVE-2008-3790

Published: Aug 27, 2008Modified: Apr 23, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

The REXML module in Ruby 1.8.6 through 1.8.6-p287, 1.8.7 through 1.8.7-p72, and 1.9 allows context-dependent attackers to cause a denial of service (CPU consumption) via an XML document with recursively nested entities, aka an "XML entity explosion."

Affected (21)

Products: Ruby Lang: Ruby

Ruby Lang

1 product

Ruby

Configuration A

21 vulnerable

Vulnerable Software	Affected Versions
Ruby Lang Ruby	Version 1.8.6
Ruby Lang Ruby	Version 1.8.6 p110
Ruby Lang Ruby	Version 1.8.6 p111
Ruby Lang Ruby	Version 1.8.6 p114
Ruby Lang Ruby	Version 1.8.6 p230
Ruby Lang Ruby	Version 1.8.6 p286
Ruby Lang Ruby	Version 1.8.6 p287
Ruby Lang Ruby	Version 1.8.6 p36
Ruby Lang Ruby	Version 1.8.6 preview1
Ruby Lang Ruby	Version 1.8.6 preview2
Ruby Lang Ruby	Version 1.8.6 preview3
Ruby Lang Ruby	Version 1.8.7
Ruby Lang Ruby	Version 1.8.7 p17
Ruby Lang Ruby	Version 1.8.7 p22
Ruby Lang Ruby	Version 1.8.7 p71
Ruby Lang Ruby	Version 1.8.7 p72
Ruby Lang Ruby	Version 1.8.7 preview1
Ruby Lang Ruby	Version 1.8.7 preview2
Ruby Lang Ruby	Version 1.8.7 preview3
Ruby Lang Ruby	Version 1.8.7 preview4
Ruby Lang Ruby	Version 1.9

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (70)

http://groups.google.com/group/comp.lang.ruby/browse_thread/thread/19f69e8a081fc0d1/e138e014b74352ca

Source: cve@mitre.org

http://lists.apple.com/archives/security-announce/2009/May/msg00002.html

Source: cve@mitre.org

http://secunia.com/advisories/31602

Source: cve@mitre.org

http://secunia.com/advisories/32165

Source: cve@mitre.org

http://secunia.com/advisories/32219

Source: cve@mitre.org

http://secunia.com/advisories/32255

Source: cve@mitre.org

http://secunia.com/advisories/32256

Source: cve@mitre.org

http://secunia.com/advisories/32371

Source: cve@mitre.org

http://secunia.com/advisories/33178

Source: cve@mitre.org

http://secunia.com/advisories/33185

Source: cve@mitre.org

http://secunia.com/advisories/35074

Source: cve@mitre.org

http://security.gentoo.org/glsa/glsa-200812-17.xml

Source: cve@mitre.org

http://support.apple.com/kb/HT3549

Source: cve@mitre.org

http://support.avaya.com/elmodocs2/security/ASA-2008-424.htm

Source: cve@mitre.org

http://weblog.rubyonrails.org/2008/9/3/rails-2-0-4-maintenance-release

Source: cve@mitre.org

http://www.debian.org/security/2008/dsa-1651

Source: cve@mitre.org

http://www.debian.org/security/2008/dsa-1652

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2008/08/25/4

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2008/08/26/1

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2008/08/26/4

Source: cve@mitre.org

http://www.redhat.com/support/errata/RHSA-2008-0897.html

Source: cve@mitre.org

http://www.ruby-lang.org/en/news/2008/08/23/dos-vulnerability-in-rexml/

Source: cve@mitre.org

ExploitPatch

http://www.ruby-lang.org/security/20080823rexml/rexml-expansion-fix.rb

Source: cve@mitre.org

Patch

http://www.securityfocus.com/bid/30802

Source: cve@mitre.org

http://www.securitytracker.com/id?1020735

Source: cve@mitre.org

http://www.us-cert.gov/cas/techalerts/TA09-133A.html

Source: cve@mitre.org

US Government Resource

http://www.vupen.com/english/advisories/2008/2428

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2008/2483

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2009/1297

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/44628

Source: cve@mitre.org

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10393

Source: cve@mitre.org

https://usn.ubuntu.com/651-1/

Source: cve@mitre.org

https://usn.ubuntu.com/691-1/

Source: cve@mitre.org

https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00259.html

Source: cve@mitre.org

https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00299.html

Source: cve@mitre.org

http://groups.google.com/group/comp.lang.ruby/browse_thread/thread/19f69e8a081fc0d1/e138e014b74352ca