oss-security - CVE Request (ruby)

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / news community lists wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [thread-next>] [month] [year] [list]

Date: Mon, 25 Aug 2008 15:20:31 +0200
From: Jan Lieskovsky <jlieskov@...hat.com>
To: coley@...re.org
Cc: oss-security@...ts.openwall.com
Subject: CVE Request (ruby)

Hello Steve,

  Ruby upstream has announced another security flaw
(DoS vulnerability in REXML module):

http://www.ruby-lang.org/en/news/2008/08/23/dos-vulnerability-in-rexml/

Test case available in part: "Impact".

Proposed preliminary fix: http://www.ruby-lang.org/security/20080823rexml/rexml-expansion-fix.rb

Testing status: REXML parsing of provided *.xml file causes
                100% cpu usage for about 1 and 1/4 minutes
                (checked the ruby-1.8.5-5.5 case).

Could you please assign a CVE id for it?

Thank you in advance.

Kind regards
Jan iankko Lieskovsky
RH Security Response Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.