Date: Mon, 25 Aug 2008 15:20:31 +0200 From: Jan Lieskovsky <jlieskov@...hat.com> To: coley@...re.org Cc: oss-security@...ts.openwall.com Subject: CVE Request (ruby) Hello Steve, Ruby upstream has announced another security flaw (DoS vulnerability in REXML module): http://www.ruby-lang.org/en/news/2008/08/23/dos-vulnerability-in-rexml/ Test case available in part: "Impact". Proposed preliminary fix: http://www.ruby-lang.org/security/20080823rexml/rexml-expansion-fix.rb Testing status: REXML parsing of provided *.xml file causes 100% cpu usage for about 1 and 1/4 minutes (checked the ruby-1.8.5-5.5 case). Could you please assign a CVE id for it? Thank you in advance. Kind regards Jan iankko Lieskovsky RH Security Response Team
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.