Medium: ruby20

2014-11-0512:16:00

alas.aws.amazon.com

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.095 Low

EPSS

Percentile

94.7%

JSON

Issue Overview:

The REXML parser in Ruby 1.9.x before 1.9.3-p550, 2.0.x before 2.0.0-p594, and 2.1.x before 2.1.4 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document, aka an XML Entity Expansion (XEE) attack.

Affected Packages:

ruby20

Issue Correction:
Run yum update ruby20 to update your system.

New Packages:

i686:  
    ruby20-debuginfo-2.0.0.594-1.19.amzn1.i686  
    ruby20-2.0.0.594-1.19.amzn1.i686  
    ruby20-devel-2.0.0.594-1.19.amzn1.i686  
    rubygem20-bigdecimal-1.2.0-1.19.amzn1.i686  
    rubygem20-psych-2.0.0-1.19.amzn1.i686  
    ruby20-libs-2.0.0.594-1.19.amzn1.i686  
    rubygem20-io-console-0.4.2-1.19.amzn1.i686  
  
noarch:  
    rubygems20-2.0.14-1.19.amzn1.noarch  
    ruby20-doc-2.0.0.594-1.19.amzn1.noarch  
    rubygems20-devel-2.0.14-1.19.amzn1.noarch  
    ruby20-irb-2.0.0.594-1.19.amzn1.noarch  
  
src:  
    ruby20-2.0.0.594-1.19.amzn1.src  
  
x86_64:  
    rubygem20-psych-2.0.0-1.19.amzn1.x86_64  
    ruby20-debuginfo-2.0.0.594-1.19.amzn1.x86_64  
    ruby20-libs-2.0.0.594-1.19.amzn1.x86_64  
    ruby20-devel-2.0.0.594-1.19.amzn1.x86_64  
    ruby20-2.0.0.594-1.19.amzn1.x86_64  
    rubygem20-io-console-0.4.2-1.19.amzn1.x86_64  
    rubygem20-bigdecimal-1.2.0-1.19.amzn1.x86_64

Additional References

Red Hat: CVE-2014-8080

Mitre: CVE-2014-8080

OSVersionArchitecturePackageVersionFilename
Amazon Linux1i686ruby20-debuginfo< 2.0.0.594-1.19.amzn1ruby20-debuginfo-2.0.0.594-1.19.amzn1.i686.rpm
Amazon Linux1i686ruby20< 2.0.0.594-1.19.amzn1ruby20-2.0.0.594-1.19.amzn1.i686.rpm
Amazon Linux1i686ruby20-devel< 2.0.0.594-1.19.amzn1ruby20-devel-2.0.0.594-1.19.amzn1.i686.rpm
Amazon Linux1i686rubygem20-bigdecimal< 1.2.0-1.19.amzn1rubygem20-bigdecimal-1.2.0-1.19.amzn1.i686.rpm
Amazon Linux1i686rubygem20-psych< 2.0.0-1.19.amzn1rubygem20-psych-2.0.0-1.19.amzn1.i686.rpm
Amazon Linux1i686ruby20-libs< 2.0.0.594-1.19.amzn1ruby20-libs-2.0.0.594-1.19.amzn1.i686.rpm
Amazon Linux1i686rubygem20-io-console< 0.4.2-1.19.amzn1rubygem20-io-console-0.4.2-1.19.amzn1.i686.rpm
Amazon Linux1noarchrubygems20< 2.0.14-1.19.amzn1rubygems20-2.0.14-1.19.amzn1.noarch.rpm
Amazon Linux1noarchruby20-doc< 2.0.0.594-1.19.amzn1ruby20-doc-2.0.0.594-1.19.amzn1.noarch.rpm
Amazon Linux1noarchrubygems20-devel< 2.0.14-1.19.amzn1rubygems20-devel-2.0.14-1.19.amzn1.noarch.rpm

OS	Version	Architecture	Package	Version	Filename
Amazon Linux	1	i686	ruby20-debuginfo	< 2.0.0.594-1.19.amzn1	ruby20-debuginfo-2.0.0.594-1.19.amzn1.i686.rpm
Amazon Linux	1	i686	ruby20	< 2.0.0.594-1.19.amzn1	ruby20-2.0.0.594-1.19.amzn1.i686.rpm
Amazon Linux	1	i686	ruby20-devel	< 2.0.0.594-1.19.amzn1	ruby20-devel-2.0.0.594-1.19.amzn1.i686.rpm
Amazon Linux	1	i686	rubygem20-bigdecimal	< 1.2.0-1.19.amzn1	rubygem20-bigdecimal-1.2.0-1.19.amzn1.i686.rpm
Amazon Linux	1	i686	rubygem20-psych	< 2.0.0-1.19.amzn1	rubygem20-psych-2.0.0-1.19.amzn1.i686.rpm
Amazon Linux	1	i686	ruby20-libs	< 2.0.0.594-1.19.amzn1	ruby20-libs-2.0.0.594-1.19.amzn1.i686.rpm
Amazon Linux	1	i686	rubygem20-io-console	< 0.4.2-1.19.amzn1	rubygem20-io-console-0.4.2-1.19.amzn1.i686.rpm
Amazon Linux	1	noarch	rubygems20	< 2.0.14-1.19.amzn1	rubygems20-2.0.14-1.19.amzn1.noarch.rpm
Amazon Linux	1	noarch	ruby20-doc	< 2.0.0.594-1.19.amzn1	ruby20-doc-2.0.0.594-1.19.amzn1.noarch.rpm
Amazon Linux	1	noarch	rubygems20-devel	< 2.0.14-1.19.amzn1	rubygems20-devel-2.0.14-1.19.amzn1.noarch.rpm