CVE-2014-8090 Denial of service in n/a

Medium 5.0 Published 21 Nov 2014 Updated 6 Aug 2024

Remote attackers can cause denial of service via CPU and memory exhaustion using crafted XML with nested entity references in the Ruby REXML parser.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2014-8090?

CVE-2014-8090 is a medium-severity denial of service vulnerability in Ruby-Lang Ruby, published on 21 Nov 2014. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The REXML parser in Ruby 1.9.x before 1.9.3 patchlevel 551, 2.0.x before 2.0.0 patchlevel 598, and 2.1.x before 2.1.5 allows remote attackers to cause a denial of service (CPU and memory consumption) a crafted XML document containing an empty string in an entity that is used in a large number of nested entity references, aka an XML Entity Expansion (XEE) attack. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-1821 and CVE-2014-8080.

Which versions are affected by CVE-2014-8090?

It affects 1 product.

Products include Ruby-Lang Ruby.

How do I fix CVE-2014-8090?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2014-8090 being exploited?

There is no known exploitation of CVE-2014-8090 in the wild and no public exploit code.

All Ruby-Lang Ruby vulnerabilities

Sources

Also known as GHSA-2x97-vvh4-m4q4, UBUNTU-CVE-2014-8090, USN-2412-1.