Lucene search

K
rubygemsRubySecRUBY:RUBY-2014-8080-113747
HistoryOct 26, 2014 - 9:00 p.m.

CVE-2014-8080 ruby: REXML billion laughs attack via parameter entity expansion

2014-10-2621:00:00
RubySec
rubysec.com
11

The REXML parser in Ruby 1.9.x before 1.9.3-p550, 2.0.x before 2.0.0-p594,
and 2.1.x before 2.1.4 allows remote attackers to cause a denial of
service (memory consumption) via a crafted XML document, aka an
XML Entity Expansion (XEE) attack.