Description
lib/rexml/text.rb in the REXML parser in Ruby before 1.9.3-p392 allows remote attackers to cause a denial of service (memory consumption and crash) via crafted text nodes in an XML document, aka an XML Entity Expansion (XEE) attack.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 7 | ruby1.8 | 1.8.7.358-7.1+deb7u1 | DSA-2809-1 |
| Debian 7 | ruby1.9.1 | 1.9.3.194-8.1+deb7u1 | DSA-2738-1 |
| Debian 6.0 | ruby1.8 | 1.8.7.302-2squeeze2 | DSA-2809-1 |
| Debian 6.0 | ruby1.9.1 | 1.9.2.0-2+deb6u1 | DSA-2738-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | ruby +8 | 1.8.7.352-10.el6_4 | RHSA-2013:0612 |
| RHEL 5 | ruby +8 | 1.8.5-29.el5_9 | RHSA-2013:0611 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | ruby3.3 +5 | 3.3.10-23.1.hum1 | RHSA-2026:7305 |
| Red Hat Hardened Images 1 | ruby3.4 +5 | 3.4.8-31.1.hum1 | RHSA-2026:7307 |
| Red Hat Hardened Images 1 | ruby4.0 +5 | 4.0.0-33.3.hum1 | RHSA-2026:8838 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jruby:jruby | < 1.7.3 | 1.7.3 | GHSA-hgg7-cghq-xhf4 |
Advisories 9
- RHSA-2026:7305 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 6, 2026
- RHSA-2026:8838 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 6, 2026
- RHSA-2026:7307 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 6, 2026
- RHSA-2013:0612 Red Hat Security Advisory: ruby security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2013:0611 Red Hat Security Advisory: ruby security update Red Hat Security Advisories (RHSA) · May 19, 2026
- WID-SEC-2026-1416 Ruby: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · May 7, 2026
- DSA-2738-1 ruby1.9.1 - several Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-2809-1 ruby1.8 - several Debian Security (DSA / DLA) · Mar 9, 2026
- WID-SEC-2023-1601 Red Hat JBoss Enterprise SOA Platform: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 29, 2023
References
- RHSA-2013:0612 vendor-advisory
- MDVSA-2013:124 vendor-advisory
- openSUSE-SU-2013:0603 vendor-advisory
- SSA:2013-075-01 vendor-advisory
- 52783 third-party-advisory
- DSA-2738 vendor-advisory
- openSUSE-SU-2013:0614 vendor-advisory
- http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=39384
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=702525
- https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0092
- http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html
- USN-1780-1 vendor-advisory
- 58141 vdb-entry
- 52902 third-party-advisory
- [oss-security] 20130306 CVE for Ruby Entity expansion DoS vulnerability in REXML (XML bomb) mailing-list
- https://bugzilla.redhat.com/show_bug.cgi?id=914716
- http://www.ruby-lang.org/en/news/2013/02/22/rexml-dos-2013-02-22/
- SUSE-SU-2013:0609 vendor-advisory
- DSA-2809 vendor-advisory
- RHSA-2013:1028 vendor-advisory
- RHSA-2013:0611 vendor-advisory
- RHSA-2013:1147 vendor-advisory
- SUSE-SU-2013:0647 vendor-advisory