The REXML parser in Ruby 1.9.x before 1.9.3 patchlevel 551, 2.0.x before 2.0.0 patchlevel 598, and 2.1.x before 2.1.5 allows remote attackers to cause a denial of service (CPU and memory consumption) a crafted XML document containing an empty string in an entity that is used in a large number of nested entity references, aka an XML Entity Expansion (XEE) attack. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-1821 and CVE-2014-8080.
CVSS Details
- CVSS 3.1 Base Score: 5.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apple Osx Ruby | — | Upgrade macOS to the latest version | Apr 5, 2017 | Nov 21, 2014 |
| Centos_linux | — | Upgrade rubygem-minitestUpgrade ruby-libsUpgrade rubyUpgrade rubygem-rdocUpgrade rubygem-jsonUpgrade ruby-develUpgrade rubygem-psychUpgrade ruby-tcltkUpgrade rubygemsUpgrade ruby-staticUpgrade ruby-docsUpgrade rubygem-bigdecimalUpgrade rubygem-rakeUpgrade rubygem-io-consoleUpgrade rubygems-develUpgrade ruby-rdocUpgrade ruby-docUpgrade ruby-riUpgrade ruby-irb | Dec 1, 2016 | Nov 21, 2014 |
| Gentoo Linux | — | Upgrade dev-lang/ruby. | Oct 30, 2017 | Nov 21, 2014 |
| Oracle Solaris | — | Upgrade runtime/ruby-19 to version 1.9.3.551-0.175.2.13.0.4.0 on Solaris 11.2 | May 29, 2017 | Nov 21, 2014 |
| Oracle_linux | — | Upgrade ruby193-ruby-libsUpgrade ruby-riUpgrade ruby193-rubyUpgrade ruby193-rubygem-jsonUpgrade ruby193-ruby-develUpgrade ruby-docsUpgrade ruby193-rubygem-rdocUpgrade ruby-staticUpgrade ruby193-ruby-tcltkUpgrade ruby193-rubygems-develUpgrade ruby193-ruby-docUpgrade ruby193-rubygemsUpgrade ruby193-ruby-irbUpgrade ruby-develUpgrade ruby193-rubygem-io-consoleUpgrade ruby-tcltkUpgrade ruby-irbUpgrade ruby-rdocUpgrade ruby193-rubygem-rakeUpgrade ruby193-rubygem-minitestUpgrade ruby-libsUpgrade rubyUpgrade ruby193-rubygem-bigdecimal | Oct 16, 2024 | Nov 21, 2014 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Nov 13, 2014 |
| Suse | — | Upgrade ruby-tkUpgrade ruby2.1-stdlibUpgrade ruby-examplesUpgrade ruby-doc-riUpgrade rubyUpgrade ruby-develUpgrade ruby-test-suiteUpgrade libruby2_1-2_1Upgrade ruby-doc-htmlUpgrade ruby2.1Upgrade ruby2.1-devel | Dec 18, 2015 | Nov 21, 2014 |
| Ubuntu | — | Upgrade libruby1.8Upgrade ruby1.8Upgrade libruby1.9.1Upgrade libruby2.1Upgrade ruby2.1Upgrade ruby2.0Upgrade libruby2.0Upgrade ruby1.9.1 | Nov 8, 2024 | Nov 21, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub